Furl for Perl unbounded HTTP response decompression exhausts memory
A Perl web-request part can be made to stop running.
Summary
Furl, a Perl HTTP client module, decompresses response bodies with no size limit. A malicious server or an attacker on a plain HTTP connection can send a small compressed response that exhausts client memory and ends the process.
What to do
No fixed version is named in the sources. Check that the installed Furl is newer than 3.15 and read the vendor's advisory.
Products and platforms
CVE IDs
Sources
- Write-up: metacpan.org (opens in a new tab)
Times
First published
First seen