Skip to content
OpenAdvisories
High · 7.3 CVE-2022-31081 EUVD-2022-52739

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in HTTP::Daemon

Published Jun 27, 2022 · Updated Apr 22, 2025 · Assigned by GitHub_M

Description

HTTP::Daemon is a simple http server class written in perl. Versions prior to 6.15 are subject to a vulnerability which could potentially be exploited to gain privileged access to APIs or poison intermediate caches. It is uncertain how large the risks are, most Perl based applications are served on top of Nginx or Apache, not on the `HTTP::Daemon`. This library is commonly used for local development and tests. Users are advised to update to resolve this issue. Users unable to upgrade may add additional request handling logic as a mitigation. After calling `my $rqst = $conn->get_request()` one could inspect the returned `HTTP::Request` object. Querying the 'Content-Length' (`my $cl = $rqst->header('Content-Length')`) will show any abnormalities that should be dealt with by a `400` response. Expected strings of 'Content-Length' SHOULD consist of either a single non-negative integer, or, a comma separated repetition of that number. (that is `42` or `42, 42, 42`). Anything else MUST be rejected.

Affected products

VendorProductAffectedFixed
libwww-perl HTTP-Daemon < 6.15 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 libhttp-daemon-perl 6.14-1.1 —
Debian 13 libhttp-daemon-perl 6.14-1.1 —
Debian 12 libhttp-daemon-perl 6.14-1.1 —
Debian 10 libhttp-daemon-perl 6.01-3+deb10u1 DLA-3127-1
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS libhttp-daemon-perl 6.13-1ubuntu0.1 USN-5520-1
Ubuntu 20.04 LTS libhttp-daemon-perl 6.06-1ubuntu0.1 USN-5520-1
Ubuntu 18.04 LTS libhttp-daemon-perl 6.01-1ubuntu0.1 USN-5520-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 16.04 LTS libhttp-daemon-perl 6.01-1ubuntu0.16.04~esm1 USN-5520-2
Ubuntu Pro 14.04 LTS libhttp-daemon-perl 6.01-1ubuntu0.14.04~esm1 USN-5520-2
ReleasePackageFixed inAdvisory
SLES 15 SP4 perl-HTTP-Daemon 6.01-150000.3.5.1 SUSE-SU-2022:2874-1
SLES 15 SP3 perl-HTTP-Daemon 6.01-150000.3.5.1 SUSE-SU-2022:2874-1
SLES 12 SP5 perl-HTTP-Daemon 6.01-9.5.1 SUSE-SU-2022:2872-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 12 SP5 perl-HTTP-Daemon 6.01-9.5.1 SUSE-SU-2022:2872-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed perl-HTTP-Daemon 6.14-2.1 openSUSE-SU-2024:12216-1
openSUSE Leap 15.4 perl-HTTP-Daemon 6.01-150000.3.5.1 SUSE-SU-2022:2874-1
openSUSE Leap 15.3 perl-HTTP-Daemon 6.01-150000.3.5.1 SUSE-SU-2022:2874-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 perl-HTTP-Daemon +1 6.16-1.amzn2023 ALAS2023-2023-247
Amazon Linux 2 perl-HTTP-Daemon 6.01-8.amzn2.0.1 ALAS2-2024-2405

Advisories 10

References