Back Linuxsecurity

Fedora 43 perl-HTTP-Daemon Moderate RCE Risk CVE-2026

Linuxsecurity •LinuxSecurity Advisories • June 19, 2026

Changes: 6.17 2026-05-19 23:11:06Z Fix CVE-2026-8450 (affects 6.15 and earlier): 2-arg open() in send_file() enabled RCE / arbitrary file write / response-body exfiltration when a string argument was derived from attacker- influenced input. send_file() now uses 3-arg open() with an explicit ' path', etc.) are no longer interpreted. send_file() now also returns '0E0' (true zero) on a successful zero-byte transfer so callers can distinguish empty file from open failure (undef). See for the advisory. Reported and patched by Stig Palmquist (stigtsp). (Stig Palmquist, Olaf Alders)

* Wed May 20 2026 Michal Josef Špaček - 6.17-1 - 6.17 bump

[ 1 ] Bug #2480076 - perl-HTTP-Daemon-6.17 is available

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-f276b2154e' at the command line. For more information, refer to the dnf documentation available at

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerability in Fedora's perl-HTTP-Daemon Affects Multiple Versions A remote code execution vulnerability, CVE-2026-8450, was published on May 27, 2026, affecting perl-HTTP-Daemon versions 6.15 and earlier. The flaw arises from a two-argument open() function in send_file(), which could be exploited through attacker-influenced input, allowing arbitrary file writes and response-body exfiltration. The vulnerability has been patched in version 6.17, released on May 19, 2026, which now utilizes a three-argument open() function to mitigate the risk. Users are advised to upgrade to the latest version to protect against potential exploits. The flaw was reported and patched by Stig Palmquist. Both Fedora 43 and Fedora 44 are affected by this vulnerability, emphasizing the need for immediate action from system administrators. 2 sources 58

Extracted Entities

Fedora 43 perl-HTTP-Daemon Moderate RCE Risk CVE-2026

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (1)