Perl HTTP::Body before 1.23_01 allows resource exhaustion
Three named flaws cover unlimited form parts, leftover multipart temp files, and quadratic CPU use; the note is cut off.
44
CVE-2026-116132
Temp-file leak in Perl HTTP::Body before 1.23_01
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
HTTP::Body for Perl creates a temporary file as soon as a multipart file part starts, but only tracks it once the part finishes. A body that ends inside a file part leaves that file on disk, and cleanup never sees it. A remote attacker can repeat incomplete multipart uploads and fill the temporary directory. Any application using HTTP::Body before 1.23_01 is affected.
What to do: Upgrade HTTP::Body to 1.23_01 or later.
| Product | Affected | Fixed in |
|---|---|---|
| Perl HTTP::Body | before 1.23_01 | 1.23_01 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk. The multipart parser creates a temporary file as soon as a file part starts, but adds it to the upload list only when the part completes. Uploads are only ever deleted from that list, by the cleanup option or by the caller, so a body that ends inside a file part leaves its temporary file where nothing can find it. A remote attacker can fill the temporary directory by repeating such requests, leaving one file behind for each.
- Weakness
- CWE-459