Technical impact
Web::Simple releases before 0.035 allocate a buffer sized by the Content-Length header for all urlencoded request bodies. When a client sends a Content-Length header that greatly exceeds the actual payload size, the library pre‑allocates the claimed amount of memory before reading any data. Because the allocated buffer grows as needed, a crafted request can cause the process to request gigabytes of memory, potentially exhausting system resources and causing the application or whole server to crash or become unresponsive. This vulnerability is an uncontrolled memory allocation issue not linked to any authentication or privileged action, and it directly impacts availability by enabling an attacker to trigger resource exhaustion through ordinary HTTP POST or PUT requests.
Affected Systems
All deployments of the Perl module Web::Simple with version numbers older than 0.035 are affected. The vulnerability exists in the Web::Dispatch::ParamParser component that handles application/x-www-form-urlencoded bodies. End‑points that accept POST or other methods with a body parameter match (% body‑parameter) are susceptible.
Risk and Exploitability
The attacker can exploit the flaw by sending a simple HTTP request to any route that parses URL‑encoded bodies, with a bogus Content-Length header containing a very large value. No authentication or privilege escalation is required. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, indicating it may not yet have seen broad exploitation. However, the local system or a web application that runs Web::Simple can be shut down or severely degraded if memory exhaustion is forced. The CVSS score is 7.5, but the nature of the vulnerability and the ease of exploitation suggest a high impact scenario.
