Your message dated Sat, 24 Oct 2026 23:35:40 +0000
with message-id <[email protected]>
and subject line Bug#1151935: fixed in libweb-simple-perl 0.035-1
has caused the Debian Bug report #1151935,
regarding libweb-simple-perl: CVE-2026-114629
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1151935: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1151935
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: libweb-simple-perl
Version: 0.033-2
X-Debbugs-CC: [email protected]
Severity: important
Tags: security upstream
Hi,
The following vulnerability was published for libweb-simple-perl.
CVE-2026-114629[0]:
| Web::Simple versions before 0.035 for Perl allocate a buffer sized
| by the Content-Length header for urlencoded body parameters.
| Web::Dispatch::ParamParser::get_unpacked_body_from reads an
| application/x-www-form-urlencoded body using a single read call,
| with no cap and the return value ignored. Perl's read grows the
| buffer to the requested length before reading, so the declared
| Content-Length determines the allocation. An attacker can trigger
| this through any route whose dispatch specification has a % body-
| parameter match, such as sub (POST + %name=), sending a Content-
| Length far larger than the body actually sent. No authentication is
| involved.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-114629
https://www.cve.org/CVERecord?id=CVE-2026-114629
[1] https://lists.security.metacpan.org/cve-announce/msg/44599125/
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: libweb-simple-perl
Source-Version: 0.035-1
Done: gregor herrmann <[email protected]>
We believe that the bug you reported is fixed in the latest version of
libweb-simple-perl, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
gregor herrmann <[email protected]> (supplier of updated libweb-simple-perl
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 25 Oct 2026 01:11:56 +0200
Source: libweb-simple-perl
Architecture: source
Version: 0.035-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Perl Group <[email protected]>
Changed-By: gregor herrmann <[email protected]>
Closes: 1151935
Changes:
libweb-simple-perl (0.035-1) unstable; urgency=medium
.
* Import upstream version 0.035.
- A urlencoded body is read in chunks (CVE-2026-114629)
Closes: #1151935
* Update debian/upstream/metadata.
* Update years of upstream and packaging copyright.
* Update dependencies.
* Declare compliance with Debian Policy 4.7.4.
* Remove «Priority: optional», which is the current default.
* Annotate test-only build dependencies with <!nocheck>.
* Convert debian/watch to version 5.
Checksums-Sha1:
c8629e18e6a2565565c55e3eb45d0c101ad585e2 2786 libweb-simple-perl_0.035-1.dsc
862b377a23049ea2db26cc97b42734fea2fd59a5 61286
libweb-simple-perl_0.035.orig.tar.gz
a904b9bb0470cedf38ece15ed36f3498ac9f300f 4056
libweb-simple-perl_0.035-1.debian.tar.xz
8a98a181907099fadabeb6efde039960139c7106 129992
libweb-simple-perl_0.035-1.git.tar.xz
c336de68303e6e58a4f5834e23697d8f4e06dd7f 17776
libweb-simple-perl_0.035-1_source.buildinfo
Checksums-Sha256:
dd41df5f28adaa88d254ec56d671634a45827124144b00bbe8390157cfd26571 2786
libweb-simple-perl_0.035-1.dsc
9b7cea77a2cb09e88a78f450a4f21458a62e71e4696e7bdf2a1181694fbea21c 61286
libweb-simple-perl_0.035.orig.tar.gz
29316eb28c05dd000ba06854e8f048dd756af9c6e7970417c7b6588927a45a92 4056
libweb-simple-perl_0.035-1.debian.tar.xz
5e39a891290a3f15265d5fdfe005a355f35ac38021347fc3c166d640bc7ee342 129992
libweb-simple-perl_0.035-1.git.tar.xz
1335299bb9f88cb356f73d1ca6bcb2fe3ba6833fd5fe8884896a4017d1e833c2 17776
libweb-simple-perl_0.035-1_source.buildinfo
Files:
d2fa30267bda933d1d2ea66f9181eb13 2786 perl optional
libweb-simple-perl_0.035-1.dsc
9716ee8792ee2cbc48be653df2ae7784 61286 perl optional
libweb-simple-perl_0.035.orig.tar.gz
80dbb5680933c4a597a8f1e6f3a4bf60 4056 perl optional
libweb-simple-perl_0.035-1.debian.tar.xz
43634cca7dc814af2abcbc1ff3fca897 129992 perl None
libweb-simple-perl_0.035-1.git.tar.xz
98c6e8af3d811e1d21becb1bddf59abd 17776 perl optional
libweb-simple-perl_0.035-1_source.buildinfo
Git-Tag-Info: tag=99e74bb21143f671e18e0062176c23b55353246f
fp=d1e1316e93a760a8104d85fabb3a68018649aa06
Git-Tag-Tagger: gregor herrmann <[email protected]>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmrdPD4ACgkQYG0ITkaD
wHnOfw/+Ij2q7QJx0uE+r6JBoKDcLNnj+DLk6Giv7libAxzBS551fxOvPVO80eTp
Hlm+MqJlFxeoti0OImnmY/o9u/yksLQQhEER6Qc3zJ2rtEYPMix7Kc29FUpzqWm2
EIPF2kaGbG3a3yyDBfbBuEUZUBPQQ83UBjYd6kV9DGFg3mHsxJOvQI4bhqn13IBK
cXe9g8xCXQjLGrQjMt0pScf6Y/TihbaIKV7xysBkE5KgGunVmSyvROpFPiN0Nof7
JC9dz+qEQtYc/pg9HsN5Sbce8LkvnASYrPYUXNkeGlirM4Z5aJ+Y25ijYOa3TwOx
04koiUittqM606QEPDVBMI2LEg/pTST5NSA9N301Z6WOeKBDMdu+bd7JGs8bkm3c
vStJs21mvnfYtWohEGWZ39dYDNQ0+6w7LCiiB5vDYzplmJzub/o3ktWyzhwJT7Vx
XmSrXi/XiChIz2UBlHbOLFwN2mHa42RVXiMC031Qv0mIKrUx044UuQnvl+kuuI76
GGLtQBMpVTDu1hb7W14KvVlkCEX4a4Y+9jbXo+6TmVAQl935QBTEWU6DgQGhhl0j
RqA9WjZIx/kBOexOY7Td9kQWFaLnd6JMxJXkOK46nsABsapUnkPSYJ5jYo4+ITOZ
mU+3DL9GSI/aZ7C71DZSgCXDa+BjG7L2jM2hgZRXfhpH9R46Tgg=
=inUz
-----END PGP SIGNATURE-----
pgpWwVn_fO1ov.pgp
Description: PGP signature
--- End Message ---
