# CVE-2026-65059: Furl versions before 3.16 for Perl allow memory exhaustion via unbounded decompression of HTTP responses

Status: published. Published: 2026-11-02. Updated: 2026-11-10.

Furl versions before 3.16 for Perl allow memory exhaustion via unbounded decompression of HTTP responses.

Furl inflates a response body sent with a gzip, x-gzip or deflate Content-Encoding and appends the output to the response string with no size limit. It does this whether or not the request asked for compression, and no option caps the decompressed size. Responses read with write_file or write_code are streamed rather than held in memory.

A malicious server, or an attacker on a plain HTTP connection, can send a small compressed response that expands to exhaust the client's memory and end the process.

## Remediation

- fix: Upgrade to version 3.16 or later. (source: CNA: CPANSec)

## Affected products and versions

-  /  (Furl): ≥ 0; < 3.16 (affected, custom). Source: CNA: CPANSec

## Severity and prioritization

- CVSS 3.1: 7.5 (high); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; source: ADP: CISA-ADP

- CVSS 3.1: 7.5 (high); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; source: NVD: 134c704f-9b21-4f2e-91b3-4a467353bcc0

- CISA KEV: No listing in collected sources

- EPSS: 0.50% as of 2026-11-09; percentile 43.10%

- SSVC: exploitation none; automatable yes; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-409

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://metacpan.org/release/SYOHEX/Furl-3.15/source/lib/Furl/ZlibStream.pm (CNA: CPANSec; technical-description)

- https://github.com/tokuhirom/Furl/pull/139 (CNA: CPANSec; issue-tracking)

- https://metacpan.org/release/TOKUHIROM/Furl-3.16/changes (CNA: CPANSec; release-notes)

- http://www.openwall.com/lists/oss-security/2026/11/02/5 (ADP: CVE)

- https://github.com/tokuhirom/Furl/pull/139 (9b29abf9-4ab0-4765-b253-1875cd9b441e)

- https://metacpan.org/release/SYOHEX/Furl-3.15/source/lib/Furl/ZlibStream.pm (9b29abf9-4ab0-4765-b253-1875cd9b441e)

- http://www.openwall.com/lists/oss-security/2026/11/02/5 (af854a3a-2127-422b-91ae-364da2661108)

## Provenance

- CNA: CPANSec: https://www.cve.org/CVERecord?id=CVE-2026-65059; retrieved 2026-11-10; source updated 2026-11-10

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-65059; retrieved 2026-11-07; source updated 2026-11-06

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-65059; retrieved 2026-11-10; source updated Not reported

Revision: 37de439c8e06204e2eb7e837f21e70712283536e74ac0aa31f1b7b32f2d91813

Canonical: https://y2.dev/cve/CVE-2026-65059

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.