Critical Security Flaw in perl-HTTP-Daemon: Arbitrary Code Execution Risk
Summary
RLSA-2026:36187: Important: perl-HTTP-Daemon security update. Affects perl-HTTP-Daemon versions < 0:6.12-6.el9_8.1. Fixed in 0:6.12-6.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The perl-HTTP-Daemon package provides the HTTP::Daemon class, which is a subclass of IO::Socket::IP. This class enables the creation of HTTP/1.1 servers that listen for incoming requests on a socket. It is widely used in applications that require HTTP server capabilities. However, the package has been found to be vulnerable to a significant security issue that could allow attackers to execute arbitrary code.
Vulnerability Detail
The vulnerability identified as CVE-2026-8450 allows for arbitrary code execution via OS command injection in the send_file() method of the HTTP::Daemon class. This flaw arises from improper handling of input, which can be exploited by an attacker to execute malicious commands on the server. The ramifications of this vulnerability are severe, as it could lead to unauthorized access, data breaches, and complete system compromise.
How To Fix
Minimum fixed version
0:6.12-6.el9_8.1
This is the first release that contains the fix.
sudo dnf update perl-HTTP-DaemonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the HTTP server or disable the functionality that utilizes the send_file() method until the package is updated. This can be done by modifying your server configuration to limit incoming requests or by removing the affected functionality.
Conclusion
The perl-HTTP-Daemon package has a critical vulnerability (CVE-2026-8450) that allows for arbitrary code execution. It is crucial to update to the patched version to protect your systems from potential exploitation. Implementing workarounds can provide temporary relief, but a full update is necessary for long-term security.
See every vulnerability recorded for perl-HTTP-Daemon →
FAQ
CVE-2026-8450 is a vulnerability in the perl-HTTP-Daemon package that allows for arbitrary code execution through OS command injection.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring a signup.
The potential impacts include unauthorized access to the server, data breaches, and the ability for attackers to execute arbitrary commands, leading to system compromise.
Yes, a patch is available. You should update to version 0:6.12-6.el9_8.1 or later of the perl-HTTP-Daemon package to fix the vulnerability.
If you cannot update the package immediately, consider implementing access restrictions to the HTTP server or disabling the affected functionality as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for perl-HTTP-Daemon.
