Critical Security Flaw in perl-HTTP-Daemon: Arbitrary Code Execution Risk
Summary
ALSA-2026:36187: Important: perl-HTTP-Daemon security update. Affects perl-HTTP-Daemon versions < 6.12-6.el9_8.1. Fixed in 6.12-6.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The perl-HTTP-Daemon package is an essential component in the Perl programming ecosystem, providing a simple HTTP/1.1 server implementation through the HTTP::Daemon class. This package allows developers to create web servers that can handle incoming HTTP requests. However, it has been identified that the package is vulnerable to a significant security flaw that could lead to arbitrary code execution, posing a serious risk to applications utilizing this package.
Vulnerability Detail
The vulnerability arises from an OS command injection issue in the send_file() method of the HTTP::Daemon class. This flaw allows an attacker to execute arbitrary commands on the server by manipulating the input to the send_file() function. If exploited, this could lead to unauthorized access, data breaches, or complete system compromise, making it critical for users of this package to address the issue promptly.
How To Fix
Minimum fixed version
6.12-6.el9_8.1
This is the first release that contains the fix.
sudo dnf update perl-HTTP-DaemonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the HTTP server or implement input validation to sanitize any user inputs before they are processed by the send_file() method. However, this is not a permanent solution and updating the package is strongly recommended.
Conclusion
The perl-HTTP-Daemon package has a critical vulnerability that can lead to arbitrary code execution. It is essential for users to update to the latest patched version to mitigate risks. Temporary workarounds can be employed, but they do not replace the need for an update.
See every vulnerability recorded for perl-HTTP-Daemon →
FAQ
The vulnerability allows for arbitrary code execution via OS command injection in the send_file() method.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without any signup.
Exploitation of this vulnerability could lead to unauthorized access, data breaches, or complete system compromise.
Yes, the patched version of perl-HTTP-Daemon is 6.12-6.el9_8.1 or later.
Implement input validation to sanitize user inputs and restrict access to the HTTP server as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for perl-HTTP-Daemon.
