Debian Patches
Status for libfurl-perl/3.15-2
| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| 1001_relax_timeout_errormsg.patch | Relax detection of timeout error message | Jonas Smedegaard <dr@jones.dk> | no | 2017-10-01 | ||
| 1002_unset_http_proxy.patch | Unset environment variable http_proxy (in addition to HTTP_PROXY) | Jonas Smedegaard <dr@jones.dk> | no | 2025-10-18 | ||
| 1003_proxy_localhost.patch | Adjust tests to IPv6-enabled HTTP::Proxy. The patch from https://rt.cpan.org/Public/Bug/Display.html?id=120275 adds IPv6 support to HTTP::Proxy (in Debian added as HTTP-Proxy-0.304-Support-IPv6.patch in libhttp-proxy-perl since 0.304-4). . As HTTP::Proxy listens by default on 'localhost', the three tests t/100_low/08_proxy.t, t/100_low/18_no_proxy.t, t/100_low/32_proxy_auth.t now fail, as they expect the proxy to run on 127.0.0.1 whereas localhost can be ::1 now. . Change the three tests to run the proxy server explicitly on 127.0.0.1. |
gregor herrmann <gregoa@debian.org> | yes | debian upstream | vendor | 2025-10-18 |
| 0001-fix-protect-against-zip-bombs-CVE-2026-65059.patch | fix: protect against zip bombs (CVE-2026-65059) Furl allows memory exhaustion via unbounded decompression of HTTP responses. Furl inflates a response body sent with a gzip, x-gzip or deflate Content-Encoding and appends the output to the response string with no size limit. It does this whether or not the request asked for compres\ sion, and no option caps the decompressed size. Responses read with write_file or write_code are streamed rather than held in memory. A malicious server, or an attacker on a plain HTTP connection, can send a small compressed response that expands to exhaust the client's memory and end the process. |
Robert Rothenberg <rrwo@cpansec.org> | yes | debian upstream | 2026-11-02 | |
| 0001-Refine-max_decompressed_size-no-default-limit-when-s.patch | Refine max_decompressed_size: no default limit when streaming, return 500 Follow-up to the zip bomb fix (CVE-2026-65059): - The default 100 MiB limit applies only to bodies held in memory. Bodies streamed with write_file/write_code do not grow in memory, so they keep working without a limit as before (e.g. large downloads served with Content-Encoding: gzip). An explicit limit, given to new or per request, still applies to both. - Going over the limit returns an internal 500 response (X-Internal-Response) instead of dying, like Furl's other transport errors. Other exceptions, such as one from a write_code callback, still propagate. - The 100 MiB in-memory test runs only with AUTHOR_TESTING. - Skip Test::TCP's port probe in the test server (uninitialized warnings). - Add a Changes entry. Followup for |
Claude <noreply@anthropic.com> | yes | debian upstream | 2026-11-06 |