/ 
Furl-3.15
⭐ Starred 104 / Furl::Request
Security Advisories (1)
CVE-2026-65059 (2026-11-02)

Furl versions through 3.15 for Perl allow memory exhaustion via unbounded decompression of HTTP responses. Furl inflates a response body sent with a gzip, x-gzip or deflate Content-Encoding and appends the output to the response string with no size limit. It does this whether or not the request asked for compression, and no option caps the decompressed size. Responses read with write_file or write_code are streamed rather than held in memory. A malicious server, or an attacker on a plain HTTP connection, can send a small compressed response that expands to exhaust the client's memory and end the process.

NAME

Furl::Request - Request object for Furl

SYNOPSIS

my $f = Furl->new;
my $req = Furl::Request->new($method, $uri, $headers, $content);
my $res = $f->request($req);

print $req->request_line, "\n";
my $http_req = $req->as_http_request;
my $req_hash = $req->as_hashref;

DESCRIPTION

This is a HTTP request object in Furl.

CONSTRUCTOR

my $req = Furl::Request->new($method, $uri);
# or
my $req = Furl::Request->new($method, $uri, \%headers);
# or
my $req = Furl::Request->new($method, $uri, \%headers, $content);

# and

my $req = Furl::Request->parse($http_request_raw_string);

INSTANCE METHODS

$req->method($method)

Gets/Sets HTTP request method

$req->uri($uri)

Gets/Sets request URI

$req->headers($headers)

Gets/Sets instance of Furl::Headers

$req->content($content)
$req->body($content)

Gets/Sets request body in scalar.

$req->protocol($protocol)
$req->protocol('HTTP/1.1');
print $req->protocol; #=> "HTTP/1.1"

Gets/Sets HTTP protocol in string.

$req->content_length
$req->content_type
$req->header

Shorthand to access Furl::Headers.

$req->as_http_request

Make instance of HTTP::Request from Furl::Request.

$req->as_hashref

Convert request object to HashRef.

Format is following:

method: Str
uri: Str
protocol: Str
headers: ArrayRef[Str]
content: Str
$req->request_line
print $req->request_line; #=> "GET / HTTP/1.1"

Returns HTTP request line.