Perl HTTP::Body before 1.23_01 allows resource exhaustion
Three named flaws cover unlimited form parts, leftover multipart temp files, and quadratic CPU use; the note is cut off.
44
CVE-2026-116133
CPU exhaustion in Perl HTTP::Body before 1.23_01
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
HTTP::Body for Perl rescans a buffered multipart body from the start whenever the boundary is missing or malformed, so parsing time grows with the square of the body size. A remote attacker can trigger this with a few crafted requests and exhaust worker CPU. Installations using HTTP::Body before 1.23_01 are affected.
What to do: Upgrade HTTP::Body to 1.23_01 or later.
| Product | Affected | Fixed in |
|---|---|---|
| HTTP::Body | before 1.23_01 | 1.23_01 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundary. Before the first part, and between parts, the multipart parser searches the whole buffered body for the next boundary. On a miss it keeps everything and searches again from the start when the next chunk arrives. A body with no boundary, or with a delimiter followed by neither CRLF nor "--", is therefore rescanned on every chunk, taking time quadratic in its size. A remote attacker can exhaust worker CPU with a few such requests.
- Weakness
- CWE-407