Perl HTTP::Body before 1.23_01 allows resource exhaustion
Original title: HTTP::Body versions before 1.24_01 for Perl (9 CVEs)
Three named flaws cover unlimited form parts, leftover multipart temp files, and quadratic CPU use; the note is cut off.
Robert Rothenberg reported flaws in the Perl module HTTP::Body on oss-security. Versions before 1.23_01 can exhaust memory and temporary files through unlimited form fields and multipart parts, leave a temp file from an incomplete multipart upload, and exhaust CPU by rescanning a multipart body. The post title cites nine CVEs and versions before 1.24_01, but the visible text names only three and stops mid-sentence.
Unconfirmed: The title cites nine CVEs and 1.24_01, while the excerpt names three CVEs before 1.23_01 and is truncated.
- CVE-2026-116131: unlimited form fields and multipart parts exhaust memory and temp files.
- CVE-2026-116132: an incomplete multipart upload’s temporary file is left on disk.
- CVE-2026-116133: quadratic rescanning of a multipart body can exhaust CPU.
- The title says nine CVEs and versions before 1.24_01.
Impact: Memory, CPU, and temporary-file exhaustion on the server
| Product | Affected |
|---|---|
| HTTP::Body | before 1.23_01 |
- 1.Upgrade HTTP::Body past the vulnerable releases named in the oss-security post.
- Products
- HTTP::Body
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-116131+1 related CVE | Resource exhaustion in Perl HTTP::Body before 1.23_01 | — | — | ||
| CVE-2026-116133 | CPU exhaustion in Perl HTTP::Body before 1.23_01 | — | — |
From the original article
Posted by Robert Rothenberg on Oct 28 CVE-2026-116131 HTTP::Body versions before 1. 23_01 for Perl allow memory and temporary file exhaustion via an unlimited number of form fields and multipart parts CVE-2026-116132 HTTP::Body versions before 1. 23_01 for Perl leave the temporary file of an incomplete multipart upload on disk CVE-2026-116133 HTTP::Body versions before 1.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.