HTTP::Parser::XS versions before 0.18 for Perl have a vulnerability where the PATH_INFO is truncated at an encoded NUL byte (%00) during HTTP request parsing. This occurs because the XS parser URL-decodes the request path and uses strlen() to measure it, causing the path to end prematurely at the first decoded NUL byte. The pure-Perl backend is not affected. This discrepancy can allow a remote attacker to send a path that a proxy or filter inspects fully, while the application routes on a truncated, shorter path.