[<prev] [next>] [day] [month] [year] [list]
Message-ID: <bd896c3a-f881-4469-8a4a-363a392924e4@cpansec.org>
Date: Wed, 6 May 2026 13:38:50 +0100
From: Robert Rothenberg <rrwo@...nsec.org>
To: cve-announce@...urity.metacpan.org, oss-security@...ts.openwall.com
Subject: CVE-2026-40562: Gazelle versions through 0.49 for Perl allows HTTP
Request Smuggling via Improper Header Precedence
========================================================================
CVE-2026-40562 CPAN Security Group
========================================================================
CVE ID: CVE-2026-40562
Distribution: Gazelle
Versions: through 0.49
MetaCPAN: https://metacpan.org/dist/Gazelle
VCS Repo: https://github.com/kazeburo/Gazelle
Gazelle versions through 0.49 for Perl allows HTTP Request Smuggling
via Improper Header Precedence
Description
-----------
Gazelle versions through 0.49 for Perl allows HTTP Request Smuggling
via Improper Header Precedence.
Gazelle incorrectly prioritizes "Content-Length" over
"Transfer-Encoding: chunked" when both headers are present in an HTTP
request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence.
An attacker could exploit this to smuggle malicious HTTP requests via a
front-end reverse proxy.
Problem types
-------------
- CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP
Request/Response Smuggling')
Workarounds
-----------
Migrate to Starman version 0.4018 or newer which has fixed the issue.
Or apply the patch.
References
----------
https://datatracker.ietf.org/doc/html/rfc7230#section-3.3.3
https://security.metacpan.org/patches/G/Gazelle/0.49/CVE-2026-40562-r1.patch
Timeline
--------
- 2026-04-12: Issue identified by CPANSec
- 2026-04-29: Issue reported to software maintainer
Credits
-------
CPANSec, finder
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
