Skip to content
OpenAdvisories
High ELSA-2026-36189 1 CVE

Important: perl-HTTP-Daemon security update (Oracle Linux 10)

Published Jul 17, 2026 · Updated Jul 17, 2026

Ecosystem: Oracle Linux

Summary

[6.16-7.1]
- Fix CVE-2026-8450: send_file() shell-magic via 2-arg open()
- Resolves: RHEL-184826

Fixed packages 1

ReleasePackageFixed in
Oracle Linux · 10 perl-HTTP-Daemon 0:6.16-7.el10_2.1

Vulnerabilities 1

  • Critical 9.1
    CVE-2026-8450

    HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file()

    HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file(). send_file() opens its string argument with Perl's 2-arg open(). The 2-arg form interprets magic prefixes: '| cmd' and 'cmd |' open a pipe to a subprocess, '> path' and '>> …

    OALDERS HTTP::Daemon libhttp-daemon-perl libhttp-daemon-perl Debian Ubuntu Azure Linux