Critical RCE Vulnerability in Fedora's perl-HTTP-Daemon Affects Multiple Versions

Linuxsecurity

Critical RCE Vulnerability in Fedora's perl-HTTP-Daemon Affects Multiple Versions

First seen 19 Jun 2026, 02:54 UTC • •57.9

Article Content

1 / 3

Browse articles

ThreatCluster •June 20, 2026 at 02:26 UTC

•CVE-2026-8450 allows remote code execution in perl-HTTP-Daemon versions 6.15 and earlier.
•The vulnerability was fixed in version 6.17, released on May 19, 2026.
•Users are urged to upgrade to the latest version to prevent exploitation.

A remote code execution vulnerability, CVE-2026-8450, was published on May 27, 2026, affecting perl-HTTP-Daemon versions 6.15 and earlier. The flaw arises from a two-argument open() function in send_file(), which could be exploited through attacker-influenced input, allowing arbitrary file writes and response-body exfiltration. The vulnerability has been patched in version 6.17, released on May 19, 2026, which now utilizes a three-argument open() function to mitigate the risk. Users are advised to upgrade to the latest version to protect against potential exploits. The flaw was reported and patched by Stig Palmquist. Both Fedora 43 and Fedora 44 are affected by this vulnerability, emphasizing the need for immediate action from system administrators.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 94d ago How this analysis works

Timeline

2026-05-19

Patch released for perl-HTTP-Daemon

Version 6.17 was released, fixing CVE-2026-8450 by changing the open() function to mitigate risks.

2026-05-27

CVE-2026-8450 published

A remote code execution vulnerability affecting perl-HTTP-Daemon versions 6.15 and earlier was disclosed.

Recent

Users urged to upgrade

System administrators are advised to upgrade to perl-HTTP-Daemon 6.17 to protect against the vulnerability.

More articles in this cluster (2)

Threat Graph

5 entities, 4 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (1)

Zero-day Exploit

Vulnerability (1)

CVE-2026-8450

Weakness (2)

CWE-22 - Path Traversal
CWE-78 - OS Command Injection

Affected Platform (1)

Linux

Relationships

CVE-2026-8450 targets Linux
Zero-day Exploit targets Linux
CVE-2026-8450 related to CWE-22 - Path Traversal
CVE-2026-8450 related to CWE-78 - OS Command Injection

Following this threat?

Track CVE-2026-8450 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical WSO2 API Manager Vulnerability Under Active Exploitation A critical vulnerability (CVE-2026-5430) in WSO2 API Manager is being actively exploited, allowing unauthenticated attackers to forge admin tokens via JWT authentication bypass. This flaw, which has a CVSS score of 10.0, affects multiple WSO2 products including API Manager, Universal Gateway, Traffic Manager, and API…

Critical Linux Kernel Vulnerability CVE-2025-39682 Under Active Exploitation A critical vulnerability (CVE-2025-39682) in the Linux kernel allows remote code execution through mishandling of zero-length TLS records. This flaw affects kTLS-enabled hosts running vulnerable kernel versions, exposing them to attackers without authentication. CISA added this vulnerability to its Known Exploited…