Revision history for HTTP-Daemon

6.17      2026-05-19 23:11:06Z
  - Fix CVE-2026-8450 (affects 6.15 and earlier): 2-arg open() in
    send_file() enabled RCE / arbitrary file write / response-body
    exfiltration when a string argument was derived from attacker-
    influenced input. send_file() now uses 3-arg open() with an
    explicit '<' read mode, so the path is always treated as a literal
    filename and 2-arg open() shell-magic shapes ('| cmd', 'cmd |',
    '> path', etc.) are no longer interpreted. send_file() now also
    returns '0E0' (true zero) on a successful zero-byte transfer so
    callers can distinguish empty file from open failure (undef). See
    https://www.cve.org/CVERecord?id=CVE-2026-8450 for the advisory.
    Reported and patched by Stig Palmquist (stigtsp). (Stig Palmquist,
    Olaf Alders)

6.16      2023-02-24 03:07:14Z
  - Bump LWP::UserAgent to 6.37 in TestSuggests (GH#65) (Olaf Alders)

6.15      2023-02-22 22:02:46Z
  - Fix CVE-2022-31081: Inconsistent Interpretation of HTTP Requests
    Correctly handle multiple Content-Length headers and its variants
    (Theo van Hoesel)
    Closes "Discrepancies in the Parsing of Content Length header ..." (GH#56)
    (blessingcharles)
  - kill test server with KILL rather than QUIT (GH#63) (Graham Knop)
  - Create TestServer test lib for running daemon process (GH#62) (Graham Knop)
  - Clean up tests (GH#61) (Graham Knop)

6.14      2022-03-03 20:47:51Z
  - Test using loopback rather than internet accessible address (GH#52)
    (Michal Josef Špaček)
  - Use GH Perl helpers for build and coverage jobs (GH#53) (Olaf Alders)

6.13      2022-02-09 20:39:12Z
  - Bump minimum IO::Socket::IP version to 0.32 (GH#50) (Olaf Alders)

6.12      2020-06-04 16:01:31Z
  - No changes since TRIAL release 6.11

6.11      2020-06-03 14:47:21Z (TRIAL RELEASE)
  - An IPv6 zone separator must be URI-quoted (GH#47) (Petr Pisar and Olaf
    Alders)

6.10      2020-05-26 16:20:36Z
  - No changes since TRIAL release 6.09

6.09      2020-05-25 16:52:14Z (TRIAL RELEASE)
  - Require IO::Socket::IP 0.25 so that HTTP::Tiny uses it (GH#45) (Shoichi Kaji)

6.08      2020-05-22 15:26:00Z (TRIAL RELEASE)
  - In t/chunked.t, leave choosing IP address family to IO::Socket::IP (GH#42) (Shoichi Kaji)
  - Add "IPv6 SUPPORT" section to pod (GH#43) (Shoichi Kaji)
  - Use HTTP::Tiny 0.042+ for IPv6 support (GH#41) (Shoichi Kaji)

6.07      2020-05-19 19:19:53Z (TRIAL RELEASE)
  - Prefer IP address for host in $d->url (GH#40) (Shoichi Kaji)
  - Improve documentation readability (GH#36) (Ferenc Erki)

6.06      2019-08-29 14:23:17Z
  - Delimit IPv6 numeric address with brackets and URI-quote an IPv6 zone
    separator in url() method output (GH#32) (Petr Pisar)
  - Handle undef and empty LocalAddr value in new() constructor as an
    unspecified address (GH#24, RT#123069) (Petr Pisar)
  - Use IO::Socket::IP for IPv6 support. (GH#31) (Chase Whitener)

6.05      2019-07-26 20:41:05Z
  - Added the .perltidyrc from the libwww-perl distribution
  - Tidied the test suite with perltidy
  - Tidied Daemon.pm
  - Turned on EOL and tab tests
  - Removed obvious indirect object syntax in test suite
  - Added IPv6 support. (GH#24) Thanks, @ppisar and @intrigeri
  - Added IO::Socket::IP as a prerequisite rather than IO::Socket::INET

6.04      2019-04-02 13:09:45Z
  - Remove circular dependency on LWP::RobotUA introduced in 6.02 (GH#29)
    (Olaf Alders)

6.03      2019-04-01 20:56:38Z
  - Remove circular dependency with LWP::UserAgent introduced in 6.02 (GH#27)
    (Olaf Alders)

6.02      2019-04-01 16:03:37Z
  - Added a .mailmap to properly keep up with contributors to the dist.
  - Revised the changelog to follow current format styles
  - Change port number in test (GH#5) (Perlover)

6.01    2012-02-18
  - If you bind localhost, don't trust gethostbyaddr() to resolve the address.
    RT#67247
  - Restore perl-5.8.1 compatibility.

6.00    2011-02-25
  - Initial release of HTTP-Daemon as a separate distribution. There are no code
    changes besides incrementing the version number since libwww-perl-5.837.
  - The HTTP::Daemon used to be bundled with the libwww-perl distribution.
