Skip to content
OpenAdvisories
High ALSA-2026:36188 1 CVE

Important: perl-HTTP-Daemon security update

Published Jul 7, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The perl-HTTP-Daemon package includes the [HTTP::Daemon](HTTP::Daemon) class, a subclass of IO::Socket::IP. Instances of the [HTTP::Daemon](HTTP::Daemon) class are HTTP/1.1 servers that listen on a socket for incoming requests.

Security Fix(es):

* perl-HTTP-Daemon: [HTTP::Daemon:](HTTP::Daemon:) Arbitrary code execution via OS command injection in send_file() (CVE-2026-8450)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
AlmaLinux · 8 perl-HTTP-Daemon 6.01-24.el8_10

Vulnerabilities 1

  • Critical 9.1
    CVE-2026-8450

    HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file()

    HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file(). send_file() opens its string argument with Perl's 2-arg open(). The 2-arg form interprets magic prefixes: '| cmd' and 'cmd |' open a pipe to a subprocess, '> path' and '>> …

    OALDERS HTTP::Daemon libhttp-daemon-perl libhttp-daemon-perl Debian Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-8450
  • report
    https://bugzilla.redhat.com/2481773
  • advisory
    https://errata.almalinux.org/8/ALSA-2026-36188.html