Perl HTTP::Body vulnerable to quadratic-time trailer parsing
HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time.
50
Vulnerability1 · 1 read
CVE-2026-121006
CPU exhaustion in HTTP::Body before 1.24_02 for Perl
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
HTTP::Body before version 1.24_02 for Perl parses trailers in quadratic time using HTTP::Headers. A remote attacker triggers CPU exhaustion with one request containing a large trailer. Applications using affected versions of HTTP::Body for Perl are impacted.
What to do: Upgrade HTTP::Body to 1.25.
| Product | Affected | Fixed in |
|---|---|---|
| CPAN HTTP::Body | before 1.24_02 | 1.25 |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time. Everything after the last chunk in the same call to add() is parsed with HTTP::Headers, which takes time quadratic in the number of fields of one name. For example, it takes several seconds to parse 16 KiB of "a:" lines. A remote attackercan exhause the CPU with a single request. HTTP::Body version 1.25 limits the size and number of lines in the trailer.
- Weakness
- CWE-770
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H