Furl versions through 3.15 for Perl have a vulnerability that allows memory exhaustion via unbounded decompression of HTTP responses. The library inflates compressed response bodies without limiting the decompressed size, which can cause the client to exhaust memory and crash. This occurs regardless of whether the request asked for compression, and no option exists to cap the decompressed output size. The vulnerability can be triggered by a malicious server or an attacker on a plain HTTP connection sending a small compressed response that expands excessively.