Read the docs
TI-2026-07425 Aliases CVE-2026-8450GHSA-3hc6-3p33-wq57

OS command injection in OALDERS HTTP::Daemon

Priority MEDIUM 50CWE-73Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 5 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-78.

Summary

HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file(). send_file() opens its string argument with Perl's 2-arg open(). The 2-arg form interprets magic prefixes: '| cmd' and 'cmd |' open a pipe to a subprocess, '> path' and '>> path' open the path for write or append. Untrusted input passed to send_file() can run OS commands at the daemon process UID. The read-pipe form ('cmd |') also leaks subprocess stdout into the HTTP response body. The write-mode forms can create or truncate files at attacker chosen paths.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01398 72nd percentileScored 2026-11-07
Fix Partial HTTP::Daemon (OALDERS): 6.17Red Hat: 5 advisoriesRed Hat: 5 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OALDERSHTTP::Daemonbefore 6.176.17Patch availableCNA
  • HTTP::Daemon VendorOALDERS Affected before 6.17 Fixed in 6.17 Patch available CNA

Remediation

  • Fix · CNA HTTP::Daemon (OALDERS) Fixed in 6.17

Red Hat 5 advisories

  • RHSA-2026:93586 Released 2026-11-02 · Red Hat rating Important
    perl-HTTP-Daemon security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) perl-HTTP-Daemon-6.12-6.el9_6.1
  • RHSA-2026:93585 Released 2026-11-02 · Red Hat rating Important
    perl-HTTP-Daemon security update
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) perl-HTTP-Daemon-6.16-7.el10_0.1
  • RHSA-2026:36187 Released 2026-07-07 · Red Hat rating Important
    perl-HTTP-Daemon security update
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) perl-HTTP-Daemon-6.12-6.el9_8.1
Show 2 more Red Hat advisories
  • RHSA-2026:36189 Released 2026-07-07 · Red Hat rating Important
    perl-HTTP-Daemon security update
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) perl-HTTP-Daemon-6.16-7.el10_2.1
  • RHSA-2026:36188 Released 2026-07-07 · Red Hat rating Important
    perl-HTTP-Daemon security update
    • Red Hat Enterprise Linux CRB (v. 8) perl-HTTP-Daemon-6.01-24.el8_10

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix yet
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:93586
Red Hat Enterprise Linux CRB (v. 8)Fixed RHSA-2026:36188
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:36189
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:36187
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:93585

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-8450
  2. 2026-10-03 Alias added: GHSA-3hc6-3p33-wq57
  3. 2026-11-02 Fix available: RHSA-2026:93586 · Red Hat
  4. 2026-11-02 Fix available: RHSA-2026:93585 · Red Hat
  5. 2026-11-02 Fix available: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) · Red Hat

References

Patch 1

Other 2

  • TI-2026-12419 Regular expression denial of service in OALDERS HTTP::Date CVSS 3.1HIGH 7.5
  • TI-2026-07753 Use after free in OALDERS HTML::Entities CVSS 3.1HIGH 7.5
  • TI-2026-07361 Insufficiently protected credentials in OALDERS LWP::UserAgent CVSS 3.1MEDIUM 6.5
  • TI-2026-07568 Deserialization of untrusted data in OALDERS WWW::Mechanize::Cached CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences