Furl (Perl HTTP client): memory exhaustion via unbounded gzip/deflate response decompression (CVE-2026-65059)
Severity: medium · Patch status: unpatched · Since 2026-11-02 · CVE-2026-65059
The CPAN Security Group disclosed CVE-2026-65059 on 2026-11-02: Furl, a Perl HTTP client, versions through 3.15 inflate response bodies with gzip, x-gzip or deflate Content-Encoding and append the output to the in-memory response string with no size limit, regardless of whether compression was requested, and offer no option to cap decompressed size. A malicious server, or an attacker on a plain HTTP connection, can send a small compressed response that expands to exhaust client memory and kill the process (CWE-409, data amplification). Responses streamed via writefile or writecode are not held in memory and are unaffected. No fixed CPAN release is available yet; a fix is discussed in GitHub PR 139. Any application using Furl to fetch content from untrusted or attacker-influenced servers is affected.
What to do
- Inventory Perl services and scripts using Furl and identify those fetching from untrusted or attacker-controllable servers
- Where possible, switch affected fetches to write_file/write_code streaming so bodies are not held in memory
- Apply size limits upstream (e.g., proxy or validate Content-Length / decompressed size) or use an alternative HTTP client until a fixed Furl release ships
- Monitor the Furl MetaCPAN page and GitHub PR #139 for the fixed release and patch promptly when available
Sources
All live incidents on Threat Watch
