CVE catalog

CVE-2022-31081

libhttp-daemon-perl affected and fixed versions

[CVE catalog]

HTTP::Daemon is a simple http server class written in perl. Versions prior to 6.15 are subject to a vulnerability which could potentially be exploited to gain privileged access to APIs or poison intermediate caches. It is uncertain how large the risks are, most Perl based applications are served on top of Nginx or Apache, not on the `HTTP::Daemon`. This library is commonly used for local development and tests. Users are advised to update to resolve this issue. Users unable to upgrade may add additional request handling logic as a mitigation. After calling `my $rqst = $conn->get_request()` one could inspect the returned `HTTP::Request` object. Querying the 'Content-Length' (`my $cl = $rqst->header('Content-Length')`) will show any abnormalities that should be dealt with by a `400` response. Expected strings of 'Content-Length' SHOULD consist of either a single non-negative integer, or, a comma separated repetition of that number. (that is `42` or `42, 42, 42`). Anything else MUST be rejected.

Severity
Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
2.35% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debiantrixie-securitylibhttp-daemon-perl6.16-1+deb13u1Fixed[CVE-2022-31081]
Debiantrixielibhttp-daemon-perl6.14-1.1FixedDistribution-reported fixed boundary[CVE-2022-31081]
Debiantrixielibhttp-daemon-perl6.16-1+deb13u1Fixed[CVE-2022-31081]
Debiansidlibhttp-daemon-perl6.14-1.1FixedDistribution-reported fixed boundary[CVE-2022-31081]
Debiansidlibhttp-daemon-perl6.17-1Fixed[CVE-2022-31081]
Debianforkylibhttp-daemon-perl6.14-1.1FixedDistribution-reported fixed boundary[CVE-2022-31081]
Debianforkylibhttp-daemon-perl6.17-1Fixed[CVE-2022-31081]
Debianbookworm-securitylibhttp-daemon-perl6.16-1+deb13u1~deb12u1Fixed[CVE-2022-31081]
Debianbookwormlibhttp-daemon-perl6.14-1.1FixedDistribution-reported fixed boundary[CVE-2022-31081]
Debianbookwormlibhttp-daemon-perl6.16-1+deb13u1~deb12u1Fixed[CVE-2022-31081]

Showing 10 fix observations. All 28 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
UnknownRelease not reportedlibhttp-daemon-perl6.14-1.1UnknownSource applicability is not establishedProvider not reported
Debianbookwormlibhttp-daemon-perl6.14-1.1FixedDistribution-reported fixed boundary[CVE-2022-31081]
Debianbookwormlibhttp-daemon-perl6.16-1+deb13u1~deb12u1Fixed[CVE-2022-31081]
Debianbookworm-securitylibhttp-daemon-perl6.16-1+deb13u1~deb12u1Fixed[CVE-2022-31081]
Debianforkylibhttp-daemon-perl6.14-1.1FixedDistribution-reported fixed boundary[CVE-2022-31081]
Debianforkylibhttp-daemon-perl6.17-1Fixed[CVE-2022-31081]
Debiansidlibhttp-daemon-perl6.14-1.1FixedDistribution-reported fixed boundary[CVE-2022-31081]
Debiansidlibhttp-daemon-perl6.17-1Fixed[CVE-2022-31081]
Debiantrixielibhttp-daemon-perl6.14-1.1FixedDistribution-reported fixed boundary[CVE-2022-31081]
Debiantrixielibhttp-daemon-perl6.16-1+deb13u1Fixed[CVE-2022-31081]
Debiantrixie-securitylibhttp-daemon-perl6.16-1+deb13u1Fixed[CVE-2022-31081]
Opensuseleap 15.3perl-HTTP-Daemon6.01-150000.3.5.1UnknownSource applicability is not established[SUSE-SU-2022:2874-1]
Opensuseleap 15.4perl-HTTP-Daemon6.01-150000.3.5.1UnknownSource applicability is not established[SUSE-SU-2022:2874-1]
Opensusetumbleweedperl-HTTP-Daemon6.14-2.1UnknownSource applicability is not established[OPENSUSE-SU-2024:12216-1]
Suselinux enterprise module for basesystem 15 sp3perl-HTTP-Daemon6.01-150000.3.5.1UnknownSource applicability is not established[SUSE-SU-2022:2874-1]
Suselinux enterprise module for basesystem 15 sp4perl-HTTP-Daemon6.01-150000.3.5.1UnknownSource applicability is not established[SUSE-SU-2022:2874-1]
Suselinux enterprise server 12 sp5perl-HTTP-Daemon6.01-9.5.1UnknownSource applicability is not established[SUSE-SU-2022:2872-1]
Suselinux enterprise server for sap applications 12 sp5perl-HTTP-Daemon6.01-9.5.1UnknownSource applicability is not established[SUSE-SU-2022:2872-1]
Ubuntu18.04libhttp-daemon-perl6.01-1UnknownSource applicability is not established[USN-5520-1][UBUNTU-CVE-2022-31081]
Ubuntu18.04libhttp-daemon-perl6.01-1ubuntu0.1UnknownSource applicability is not established[USN-5520-1][UBUNTU-CVE-2022-31081]
Ubuntu20.04libhttp-daemon-perl6.04-1UnknownSource applicability is not established[USN-5520-1][UBUNTU-CVE-2022-31081]
Ubuntu20.04libhttp-daemon-perl6.06-1UnknownSource applicability is not established[USN-5520-1][UBUNTU-CVE-2022-31081]
Ubuntu20.04libhttp-daemon-perl6.06-1ubuntu0.1UnknownSource applicability is not established[USN-5520-1][UBUNTU-CVE-2022-31081]
Ubuntu22.04libhttp-daemon-perl6.12-1UnknownSource applicability is not established[USN-5520-1][UBUNTU-CVE-2022-31081]
Ubuntu22.04libhttp-daemon-perl6.13-1UnknownSource applicability is not established[USN-5520-1][UBUNTU-CVE-2022-31081]
Ubuntu22.04libhttp-daemon-perl6.13-1ubuntu0.1UnknownSource applicability is not established[USN-5520-1][UBUNTU-CVE-2022-31081]
Ubuntuprolibhttp-daemon-perl6.01-1UnknownSource applicability is not established[USN-5520-2][UBUNTU-CVE-2022-31081]
Ubuntuprolibhttp-daemon-perl6.01-1ubuntu0.16.04~esm1UnknownSource applicability is not established[USN-5520-2][UBUNTU-CVE-2022-31081]
Original provider fields
{
  "package_releases": [
    {
      "name": "libhttp-daemon-perl",
      "status": "fixed",
      "release": "sid",
      "version": "6.17-1"
    },
    {
      "name": "libhttp-daemon-perl",
      "status": "fixed",
      "release": "forky",
      "version": "6.17-1"
    },
    {
      "name": "libhttp-daemon-perl",
      "status": "fixed",
      "release": "trixie",
      "version": "6.16-1+deb13u1"
    },
    {
      "name": "libhttp-daemon-perl",
      "status": "fixed",
      "release": "trixie-security",
      "version": "6.16-1+deb13u1"
    },
    {
      "name": "libhttp-daemon-perl",
      "status": "fixed",
      "release": "bookworm",
      "version": "6.16-1+deb13u1~deb12u1"
    },
    {
      "name": "libhttp-daemon-perl",
      "status": "fixed",
      "release": "bookworm-security",
      "version": "6.16-1+deb13u1~deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": 1014808,
      "name": "libhttp-daemon-perl",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "6.14-1.1"
    },
    {
      "bug": 1014808,
      "name": "libhttp-daemon-perl",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "6.14-1.1"
    },
    {
      "bug": 1014808,
      "name": "libhttp-daemon-perl",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "6.14-1.1"
    },
    {
      "bug": 1014808,
      "name": "libhttp-daemon-perl",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "6.14-1.1"
    }
  ],
  "distribution_packages": [
    {
      "name": "libhttp-daemon-perl",
      "fixed_version": "6.14-1.1",
      "applicability_unknown": true
    },
    {
      "name": "libhttp-daemon-perl",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.01-1ubuntu0.16.04~esm1"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "6.01-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-5520-2",
      "fixed_version": "6.01-1ubuntu0.16.04~esm1",
      "provider_source": "pypi",
      "provider_record_id": "USN-5520-2",
      "provider_updated_at": "2026-06-29T13:49:39.968493562Z",
      "applicability_unknown": true
    },
    {
      "name": "libhttp-daemon-perl",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.01-1ubuntu0.1"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "6.01-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-5520-1",
      "fixed_version": "6.01-1ubuntu0.1",
      "provider_source": "pypi",
      "provider_record_id": "USN-5520-1",
      "provider_updated_at": "2026-02-10T04:42:42Z",
      "applicability_unknown": true
    },
    {
      "name": "libhttp-daemon-perl",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.06-1ubuntu0.1"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "6.04-1",
        "6.06-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-5520-1",
      "fixed_version": "6.06-1ubuntu0.1",
      "provider_source": "pypi",
      "provider_record_id": "USN-5520-1",
      "provider_updated_at": "2026-02-10T04:42:42Z",
      "applicability_unknown": true
    },
    {
      "name": "libhttp-daemon-perl",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.13-1ubuntu0.1"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "6.12-1",
        "6.13-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-5520-1",
      "fixed_version": "6.13-1ubuntu0.1",
      "provider_source": "pypi",
      "provider_record_id": "USN-5520-1",
      "provider_updated_at": "2026-02-10T04:42:42Z",
      "applicability_unknown": true
    },
    {
      "name": "libhttp-daemon-perl",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.01-1ubuntu0.16.04~esm1"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "6.01-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-31081",
      "fixed_version": "6.01-1ubuntu0.16.04~esm1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-31081",
      "provider_updated_at": "2026-02-04T04:04:25.434761Z",
      "applicability_unknown": true
    },
    {
      "name": "libhttp-daemon-perl",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.01-1ubuntu0.1"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "6.01-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-31081",
      "fixed_version": "6.01-1ubuntu0.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-31081",
      "provider_updated_at": "2026-02-04T04:04:25.434761Z",
      "applicability_unknown": true
    },
    {
      "name": "libhttp-daemon-perl",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.06-1ubuntu0.1"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "6.04-1",
        "6.06-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-31081",
      "fixed_version": "6.06-1ubuntu0.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-31081",
      "provider_updated_at": "2026-02-04T04:04:25.434761Z",
      "applicability_unknown": true
    },
    {
      "name": "libhttp-daemon-perl",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.13-1ubuntu0.1"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "6.12-1",
        "6.13-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-31081",
      "fixed_version": "6.13-1ubuntu0.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2022-31081",
      "provider_updated_at": "2026-02-04T04:04:25.434761Z",
      "applicability_unknown": true
    },
    {
      "name": "perl-HTTP-Daemon",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.01-150000.3.5.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for basesystem 15 sp3",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:2874-1",
      "fixed_version": "6.01-150000.3.5.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:2874-1",
      "provider_updated_at": "2026-02-04T03:42:29.667924Z",
      "applicability_unknown": true
    },
    {
      "name": "perl-HTTP-Daemon",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.01-150000.3.5.1"
            }
          ]
        }
      ],
      "release": "linux enterprise module for basesystem 15 sp4",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:2874-1",
      "fixed_version": "6.01-150000.3.5.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:2874-1",
      "provider_updated_at": "2026-02-04T03:42:29.667924Z",
      "applicability_unknown": true
    },
    {
      "name": "perl-HTTP-Daemon",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.01-150000.3.5.1"
            }
          ]
        }
      ],
      "release": "leap 15.3",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:2874-1",
      "fixed_version": "6.01-150000.3.5.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:2874-1",
      "provider_updated_at": "2026-02-04T03:42:29.667924Z",
      "applicability_unknown": true
    },
    {
      "name": "perl-HTTP-Daemon",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.01-150000.3.5.1"
            }
          ]
        }
      ],
      "release": "leap 15.4",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:2874-1",
      "fixed_version": "6.01-150000.3.5.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:2874-1",
      "provider_updated_at": "2026-02-04T03:42:29.667924Z",
      "applicability_unknown": true
    },
    {
      "name": "perl-HTTP-Daemon",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.14-2.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2024:12216-1",
      "fixed_version": "6.14-2.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2024:12216-1",
      "provider_updated_at": "2026-02-04T03:24:53.576931Z",
      "applicability_unknown": true
    },
    {
      "name": "perl-HTTP-Daemon",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.01-9.5.1"
            }
          ]
        }
      ],
      "release": "linux enterprise server 12 sp5",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:2872-1",
      "fixed_version": "6.01-9.5.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:2872-1",
      "provider_updated_at": "2026-02-04T02:24:42.480038Z",
      "applicability_unknown": true
    },
    {
      "name": "perl-HTTP-Daemon",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.01-9.5.1"
            }
          ]
        }
      ],
      "release": "linux enterprise server for sap applications 12 sp5",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:2872-1",
      "fixed_version": "6.01-9.5.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2022:2872-1",
      "provider_updated_at": "2026-02-04T02:24:42.480038Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #1014808]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [libhttp-daemon-perl]Unknown
    Details (4)

    • 6.16-1+deb13u1~deb12u1 · all · bookworm

      Fixed · Fixed: 6.14-1.1

      dsa · libhttp-daemon-perl · debian · bookworm

    • 6.16-1+deb13u1~deb12u1 · all · bookworm

      Fixed · Fixed: 6.14-1.1

      dsa · libhttp-daemon-perl · debian · bookworm

    • 6.16-1+deb13u1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 6.14-1.1

      dsa · libhttp-daemon-perl · debian · bookworm

    • 6.16-1+deb13u1~deb12u1 · all · bookworm-security

      Fixed · Fixed: 6.14-1.1

      dsa · libhttp-daemon-perl · debian · bookworm

[openSUSE Tumbleweed]

  • [perl-HTTP-Daemon]Unknown

    Source package: [perl-HTTP-Daemon]

    Details (1)

    • 6.170.0-1.3 · noarch · tumbleweed

      Fixed · Fixed: 6.14-2.1

      dsa · perl-HTTP-Daemon · opensuse · tumbleweed

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]