Skip to content
OpenAdvisories
Critical RHSA-2026:93586 1 CVE

Red Hat Security Advisory: perl-HTTP-Daemon security update

Published Nov 13, 2026 · Updated Nov 13, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · RHEL 9.6 EUS rhel_eus:9.6::crb perl-HTTP-Daemon 0:6.12-6.el9_6.1

Vulnerabilities 1

  • Critical 9.1
    CVE-2026-8450

    HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file()

    HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file(). send_file() opens its string argument with Perl's 2-arg open(). The 2-arg form interprets magic prefixes: '| cmd' and 'cmd |' open a pipe to a subprocess, '> path' and '>> …

    OALDERS HTTP::Daemon libhttp-daemon-perl libhttp-daemon-perl Debian Ubuntu Azure Linux

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2481773
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_93586.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-8450
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-8450
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-8450
  • article
    https://github.com/libwww-perl/HTTP-Daemon/commit/945d35141d94490f749640bd4390acd6a2193995.patch
  • article
    https://github.com/libwww-perl/HTTP-Daemon/pull/89
  • article
    https://metacpan.org/release/OALDERS/HTTP-Daemon-6.17/changes