{"api_version":"1","generated_at":"2026-07-23T19:19:21+00:00","cve":"CVE-2022-31081","urls":{"html":"https://cve.report/CVE-2022-31081","api":"https://cve.report/api/cve/CVE-2022-31081.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-31081","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-31081"},"summary":{"title":"CVE-2022-31081","description":"HTTP::Daemon is a simple http server class written in perl. Versions prior to 6.15 are subject to a vulnerability which could potentially be exploited to gain privileged access to APIs or poison intermediate caches. It is uncertain how large the risks are, most Perl based applications are served on top of Nginx or Apache, not on the `HTTP::Daemon`. This library is commonly used for local development and tests. Users are advised to update to resolve this issue. Users unable to upgrade may add additional request handling logic as a mitigation. After calling `my $rqst = $conn->get_request()` one could inspect the returned `HTTP::Request` object. Querying the 'Content-Length' (`my $cl = $rqst->header('Content-Length')`) will show any abnormalities that should be dealt with by a `400` response. Expected strings of 'Content-Length' SHOULD consist of either a single non-negative integer, or, a comma separated repetition of that number. (that is `42` or `42, 42, 42`). Anything else MUST be rejected.","state":"PUBLIC","assigner":"security-advisories@github.com","published_at":"2022-06-27 21:15:00","updated_at":"2023-11-07 03:47:00"},"problem_types":["CWE-444"],"metrics":[],"references":[{"url":"https://github.com/libwww-perl/HTTP-Daemon/commit/e84475de51d6fd7b29354a997413472a99db70b2","name":"https://github.com/libwww-perl/HTTP-Daemon/commit/e84475de51d6fd7b29354a997413472a99db70b2","refsource":"MISC","tags":[],"title":"Fix Content-Length ', '-separated string issues · libwww-perl/HTTP-Daemon@e84475d · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ECJ4ZPBQWD3B2CD6RRIVMENB5KUOJ3LC/","name":"FEDORA-2023-748e811334","refsource":"FEDORA","tags":[],"title":"[SECURITY] Fedora 38 Update: perl-HTTP-Daemon-6.16-1.fc38 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://cwe.mitre.org/data/definitions/444.html","name":"https://cwe.mitre.org/data/definitions/444.html","refsource":"MISC","tags":[],"title":"CWE -\r\n\n\t\tCWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (4.7)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/libwww-perl/HTTP-Daemon/commit/8dc5269d59e2d5d9eb1647d82c449ccd880f7fd0","name":"https://github.com/libwww-perl/HTTP-Daemon/commit/8dc5269d59e2d5d9eb1647d82c449ccd880f7fd0","refsource":"MISC","tags":[],"title":"Include reason in response body content · libwww-perl/HTTP-Daemon@8dc5269 · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7U4XEPZ5Q3LNOQF3E6EXFWVSEXU5IZ6T/","name":"FEDORA-2023-c230cc08c4","refsource":"FEDORA","tags":[],"title":"[SECURITY] Fedora 36 Update: perl-HTTP-Daemon-6.16-1.fc36 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.debian.org/debian-lts-announce/2022/09/msg00038.html","name":"[debian-lts-announce] 20220930 [SECURITY] [DLA 3127-1] libhttp-daemon-perl security update","refsource":"MLIST","tags":[],"title":"[SECURITY] [DLA 3127-1] libhttp-daemon-perl security update","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7U4XEPZ5Q3LNOQF3E6EXFWVSEXU5IZ6T/","name":"FEDORA-2023-c230cc08c4","refsource":"","tags":[],"title":"[SECURITY] Fedora 36 Update: perl-HTTP-Daemon-6.16-1.fc36 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/libwww-perl/HTTP-Daemon/security/advisories/GHSA-cg8c-pxmv-w7cf","name":"https://github.com/libwww-perl/HTTP-Daemon/security/advisories/GHSA-cg8c-pxmv-w7cf","refsource":"CONFIRM","tags":[],"title":"Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in HTTP::Daemon · Advisory · libwww-perl/HTTP-Daemon · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://datatracker.ietf.org/doc/html/rfc7230#section-9.5","name":"https://datatracker.ietf.org/doc/html/rfc7230#section-9.5","refsource":"MISC","tags":[],"title":"RFC 7230 - Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ECJ4ZPBQWD3B2CD6RRIVMENB5KUOJ3LC/","name":"FEDORA-2023-748e811334","refsource":"","tags":[],"title":"[SECURITY] Fedora 38 Update: perl-HTTP-Daemon-6.16-1.fc38 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XQBW2D43TDNYX4R2YBTNNZDBNZ45DINN/","name":"FEDORA-2023-424636c7cb","refsource":"","tags":[],"title":"[SECURITY] Fedora 37 Update: perl-HTTP-Daemon-6.16-1.fc37 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XQBW2D43TDNYX4R2YBTNNZDBNZ45DINN/","name":"FEDORA-2023-424636c7cb","refsource":"FEDORA","tags":[],"title":"[SECURITY] Fedora 37 Update: perl-HTTP-Daemon-6.16-1.fc37 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"http://metacpan.org/release/HTTP-Daemon/","name":"http://metacpan.org/release/HTTP-Daemon/","refsource":"MISC","tags":[],"title":"HTTP-Daemon-6.12 - A simple http server class - metacpan.org","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn","name":"https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn","refsource":"MISC","tags":[],"title":"HTTP Desync Attacks: Request Smuggling Reborn | PortSwigger Research","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-31081","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31081","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2022","cve_id":"31081","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"10.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"31081","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"http\\","cpe5":"\\","cpe6":"daemon_project","cpe7":"http\\","cpe8":"\\","cpe9":"daemon","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2022-31081","qid":"181036","title":"Debian Security Update for libhttp-daemon-perl (CVE-2022-31081)"},{"cve":"CVE-2022-31081","qid":"181103","title":"Debian Security Update for libhttp-daemon-perl (DLA 3127-1)"},{"cve":"CVE-2022-31081","qid":"198863","title":"Ubuntu Security Notification for HTTP-Daemon Vulnerability (USN-5520-1)"},{"cve":"CVE-2022-31081","qid":"283769","title":"Fedora Security Update for perl (FEDORA-2023-424636c7cb)"},{"cve":"CVE-2022-31081","qid":"283770","title":"Fedora Security Update for perl (FEDORA-2023-c230cc08c4)"},{"cve":"CVE-2022-31081","qid":"284272","title":"Fedora Security Update for perl (FEDORA-2023-748e811334)"},{"cve":"CVE-2022-31081","qid":"330137","title":"IBM AIX Vulnerability in perl (perl_advisory6)"},{"cve":"CVE-2022-31081","qid":"355620","title":"Amazon Linux Security Advisory for perl-HTTP-Daemon : ALAS2023-2023-247"},{"cve":"CVE-2022-31081","qid":"752498","title":"SUSE Enterprise Linux Security Update for perl-HTTP-Daemon (SUSE-SU-2022:2874-1)"},{"cve":"CVE-2022-31081","qid":"752499","title":"SUSE Enterprise Linux Security Update for perl-HTTP-Daemon (SUSE-SU-2022:2872-1)"}]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security-advisories@github.com","ID":"CVE-2022-31081","STATE":"PUBLIC","TITLE":"Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in HTTP::Daemon"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"HTTP-Daemon","version":{"version_data":[{"version_value":"< 6.15"}]}}]},"vendor_name":"libwww-perl"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"HTTP::Daemon is a simple http server class written in perl. Versions prior to 6.15 are subject to a vulnerability which could potentially be exploited to gain privileged access to APIs or poison intermediate caches. It is uncertain how large the risks are, most Perl based applications are served on top of Nginx or Apache, not on the `HTTP::Daemon`. This library is commonly used for local development and tests. Users are advised to update to resolve this issue. Users unable to upgrade may add additional request handling logic as a mitigation. After calling `my $rqst = $conn->get_request()` one could inspect the returned `HTTP::Request` object. Querying the 'Content-Length' (`my $cl = $rqst->header('Content-Length')`) will show any abnormalities that should be dealt with by a `400` response. Expected strings of 'Content-Length' SHOULD consist of either a single non-negative integer, or, a comma separated repetition of that number. (that is `42` or `42, 42, 42`). Anything else MUST be rejected."}]},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')"}]}]},"references":{"reference_data":[{"name":"https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn","refsource":"MISC","url":"https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn"},{"name":"https://github.com/libwww-perl/HTTP-Daemon/security/advisories/GHSA-cg8c-pxmv-w7cf","refsource":"CONFIRM","url":"https://github.com/libwww-perl/HTTP-Daemon/security/advisories/GHSA-cg8c-pxmv-w7cf"},{"name":"https://github.com/libwww-perl/HTTP-Daemon/commit/8dc5269d59e2d5d9eb1647d82c449ccd880f7fd0","refsource":"MISC","url":"https://github.com/libwww-perl/HTTP-Daemon/commit/8dc5269d59e2d5d9eb1647d82c449ccd880f7fd0"},{"name":"https://github.com/libwww-perl/HTTP-Daemon/commit/e84475de51d6fd7b29354a997413472a99db70b2","refsource":"MISC","url":"https://github.com/libwww-perl/HTTP-Daemon/commit/e84475de51d6fd7b29354a997413472a99db70b2"},{"name":"https://cwe.mitre.org/data/definitions/444.html","refsource":"MISC","url":"https://cwe.mitre.org/data/definitions/444.html"},{"name":"https://datatracker.ietf.org/doc/html/rfc7230#section-9.5","refsource":"MISC","url":"https://datatracker.ietf.org/doc/html/rfc7230#section-9.5"},{"name":"http://metacpan.org/release/HTTP-Daemon/","refsource":"MISC","url":"http://metacpan.org/release/HTTP-Daemon/"},{"refsource":"MLIST","name":"[debian-lts-announce] 20220930 [SECURITY] [DLA 3127-1] libhttp-daemon-perl security update","url":"https://lists.debian.org/debian-lts-announce/2022/09/msg00038.html"},{"refsource":"FEDORA","name":"FEDORA-2023-c230cc08c4","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7U4XEPZ5Q3LNOQF3E6EXFWVSEXU5IZ6T/"},{"refsource":"FEDORA","name":"FEDORA-2023-424636c7cb","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XQBW2D43TDNYX4R2YBTNNZDBNZ45DINN/"},{"refsource":"FEDORA","name":"FEDORA-2023-748e811334","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ECJ4ZPBQWD3B2CD6RRIVMENB5KUOJ3LC/"}]},"source":{"advisory":"GHSA-cg8c-pxmv-w7cf","discovery":"UNKNOWN"}},"nvd":{"publishedDate":"2022-06-27 21:15:00","lastModifiedDate":"2023-11-07 03:47:00","problem_types":["CWE-444"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM"},"exploitabilityScore":3.9,"impactScore":2.5},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":6.4},"severity":"MEDIUM","exploitabilityScore":10,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:http\\:\\:daemon_project:http\\:\\:daemon:*:*:*:*:*:*:*:*","versionEndExcluding":"6.15","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":null,"notes":[]}}}