Security Advisories (1)
CVE-2026-65059 (2026-11-02)

Furl versions through 3.15 for Perl allow memory exhaustion via unbounded decompression of HTTP responses. Furl inflates a response body sent with a gzip, x-gzip or deflate Content-Encoding and appends the output to the response string with no size limit. It does this whether or not the request asked for compression, and no option caps the decompressed size. Responses read with write_file or write_code are streamed rather than held in memory. A malicious server, or an attacker on a plain HTTP connection, can send a small compressed response that expands to exhaust the client's memory and end the process.

NAME

Furl::Response - Response object for Furl

SYNOPSIS

my $res = Furl::Response->new($minor_version, $code, $message, $headers, $content);
print $res->status, "\n";

DESCRIPTION

This is a HTTP response object in Furl.

CONSTRUCTOR

my $res = Furl::Response->new($minor_version, $code, $msg, \%headers, $content);

INSTANCE METHODS

$res->code
$res->status

Returns HTTP status code.

$res->message

Returns HTTP status message.

$res->headers

Returns instance of Furl::Headers

$res->content
$res->body

Returns response body in scalar.

$res->decoded_content

This will return the content after any Content-Encoding and charsets have been decoded. See HTTP::Message for details

$res->request

Returns instance of Furl::Request related this response.

$res->content_length
$res->content_type
$res->content_encoding
$res->header

Shorthand to access Furl::Headers.

$res->protocol
$res->protocol(); # => "HTTP/1.1"

Returns HTTP protocol in string.

$res->as_http_response

Make instance of HTTP::Response from Furl::Response.

$res->to_psgi()

Convert object to PSGI response. It's very useful to make proxy.

$res->as_hashref()

Convert response object to HashRef.

Format is following:

code: Int
message: Str
protocol: Str
headers: ArrayRef[Str]
content: Str
$res->is_success

Returns true if status code is 2xx.

$res->status_line
$res->status_line() # => "200 OK"

Returns status line.

my $headers = $res->captured_req_headers() : Str

Captured request headers in raw string.

This method is only for debugging.

You can use this method if you are using capture_request parameter is true.

my $content = $res->captured_req_content() : Str

Captured request content in raw string.

This method is only for debugging.

You can use this method if you are using capture_request parameter is true.