{"affected":[{"defaultStatus":"unaffected","ecosystem":"cpan","packageName":"HTTP-Body","product":"","source":"CNA: CPANSec","vendor":"","versions":[{"lessThan":"1.23_01","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-116135","cwes":["CWE-178"],"description":"HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them.\n\nThe decode table holds only the all-lowercase and all-uppercase spelling of each hex pair, while the escape pattern matches either case. An escape such as %aB finds no entry and is replaced with nothing, joining the bytes on either side. Hex digits in percent escapes are case-insensitive, and conforming decoders return the byte.\n\nA remote attacker can send a field name or value that a conforming decoder in front of the application reads differently, so that pass%aBword reaches the application as password.","epss":{"date":"2026-11-05","percentile":0.27812,"score":0.00342},"exploits":[],"kev":null,"metrics":[{"score":9.8,"severity":"critical","source":"ADP: CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793912242885,"publishedAt":1793207750270,"references":[{"source":"CNA: CPANSec","tags":["patch"],"url":"https://github.com/libwww-perl/HTTP-Body/commit/336f1a23b4115a5cbeb546f36df5af62c90bdc0d.patch"},{"source":"CNA: CPANSec","tags":["release-notes"],"url":"https://metacpan.org/release/GETTY/HTTP-Body-1.24/changes"},{"source":"CNA: CPANSec","tags":[],"url":"https://www.rfc-editor.org/rfc/rfc3986#section-2.1"}],"remediation":[{"kind":"fix","source":"CNA: CPANSec","text":"Upgrade to HTTP-Body 1.23_01 or later."},{"kind":"fix","source":"CNA: CPANSec","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/libwww-perl/HTTP-Body/commit/336f1a23b4115a5cbeb546f36df5af62c90bdc0d.patch"}],"revision":"181c8b1fa7752a7a90bcc2168dad0b00dd64965d18f86bb59d900a7fd27f3f09","sources":[{"modifiedAt":1793912242885,"name":"CNA: CPANSec","retrievedAt":1793913754764,"url":"https://www.cve.org/CVERecord?id=CVE-2026-116135"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793913769050,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-116135"}],"ssvc":{"assessedAt":1793912232358,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them","updatedAt":1793913769050}