🟠 High | Source: Microsoft Security Response Center
A vulnerability in HTTP::Daemon, a Perl web server module, allows attackers to inject and execute operating system commands via the send_file() function in versions before 6.17. This is a classic OS command injection flaw, meaning an attacker could potentially run arbitrary commands on the underlying server. The issue is notable because HTTP::Daemon is a commonly used Perl dependency that may appear in Azure-hosted workloads or containerised applications.
Security Architect’s Take: Audit your Azure workloads, containers, and CI/CD pipelines for any Perl applications using HTTP::Daemon and upgrade to version 6.17 or later immediately. Pay particular attention to any internet-facing services that invoke send_file(), as these present the highest exploitation risk.
Original advisory: CVE-2026-8450 HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file()