The vulnerability in Perl's Furl library up to version 3.15 allows an attacker to trigger memory exhaustion by sending a compressed HTTP response that expands unbounded upon decompression. Furl inflates the compressed body and appends it to the response string without any size restriction, regardless of whether the client requested compression. The lack of a cap on the decompressed payload enables an attacker to consume all available memory, causing the client process to terminate or become unresponsive, resulting in a denial‑of‑service condition on the affected application.

The flaw affects all Furl releases with a version number of 3.15 or earlier when used within Perl scripts or applications that rely on the Furl HTTP client. No specific operating system or distribution is listed; any environment that imports and uses these versions is vulnerable. The issue exists in the ZlibStream module responsible for handling gzip, x-gzip, and deflate content encodings.

The exploit requires controlling the HTTP response from a server that the vulnerable client communicates with, whether over HTTPS or plain HTTP. An attacker can send a small, compressed payload that expands to occupy large amounts of memory on the client side. The CVSS score is not provided, and EPSS is unavailable; the vulnerability is not listed in KEV. Based on the description, the likely attack vector is a remote denial‑of‑service by initiating a request to the affected client or by hosting a malicious server that responds with a dangerously compressed body. The unbounded decompression corresponds to CWE‑409, indicating a failure to enforce limits on untrusted input size.