high · CVSS v3 7.5

CVE-2026-65059

CVE-2026-65059 exposes the Perl Furl library (v3.15 and earlier) to memory exhaustion when decompressing HTTP responses with gzip, x-gzip, o

Overview

CVE-2026-65059 exposes the Perl Furl library (v3.15 and earlier) to memory exhaustion when decompressing HTTP responses with gzip, x-gzip, or deflate encoding. An attacker can send a small compressed payload that expands beyond any limit, exhausting client memory and terminating the process. This flaw affects any application that uses Furl to fetch HTTP content without size checks.

Description

Furl versions through 3.15 for Perl allow memory exhaustion via unbounded decompression of HTTP responses. Furl inflates a response body sent with a gzip, x-gzip or deflate Content-Encoding and appends the output to the response string with no size limit. It does this whether or not the request asked for compression, and no option caps the decompressed size. Responses read with write_file or write_code are streamed rather than held in memory. A malicious server, or an attacker on a plain HTTP connection, can send a small compressed response that expands to exhaust the client's memory and end the process.

Impact

The vulnerability leads to a denial‑of‑service (availability) impact by exhausting system memory. Defenders using Furl in web clients, API consumers, or background jobs are at risk. It can cause process crashes, degraded performance, and potential cascading failures in dependent services.

Remediation

Upgrade Furl to version 3.16 or later where decompression size limits are enforced. If upgrading is not immediately possible, configure your application to use write_file or write_code for streaming responses, or implement a custom wrapper that caps the decompressed size. Additionally, enforce system memory limits (ulimit, cgroups) and monitor for abnormal memory usage during HTTP fetches.

Risk context

The CVE has a high severity rating (CVSS 7.5) and no EPSS data, indicating a significant risk that should be addressed promptly to prevent potential denial‑of‑service incidents.

Affected products

  • Furl 3.15
  • Furl 3.14
  • Furl 3.13
  • Furl 3.12
  • Furl 3.11
  • Furl 3.10
  • Furl 3.9
  • Furl 3.8

Scores

Severity
high
CVSS v2
7.8
CVSS v3
7.5
CVSS v4
—
EPSS
—

memory exhaustion denial of service Perl Furl HTTP decompression patch defense

← All CVEs

Related CVEs

high

CVE-2026-119301

Improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component in AWS SDK for pandas (also published as awswrangler) 3.5.2 through 3.17.0 might allow an authenticated remote user with permission to modify AWS Glue Data Catalog metadata to read any table that a separate, more privileged principal can access and write to the table that principal is updating via a crafted column name. To remediate this issue, users should upgrade to version 3.17.1 or later.

View analysis

high

CVE-2026-120830

A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause an out-of-bounds heap read, leaking host memory into the ICMP error packet returned to a guest or container.

View analysis

high

CVE-2026-120833

Labbench versions prior to 0.46.1 deserialize untrusted .p or .pickle files using pandas.read_pickle, enabling arbitrary code execution when a user loads such files. The flaw allows attackers to run malicious code on the host system. It is a high‑severity vulnerability that can compromise confidentiality, integrity, and availability of affected installations.

View analysis

high

CVE-2026-107441

An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

View analysis