Four separate Perl module advisories, not one flaw
First merged summary.
Robert Rothenberg’s late-October oss-security posts describe distinct flaws in four different Perl modules; excerpts are truncated.
oss-security carried four separate notes by Robert Rothenberg, not one shared vulnerability. On October 28 he described HTTP::Body issues before 1.23_01—while the title cites nine CVEs and versions before 1.24_01 but the text names three—and MIME-tools fixes in 5.521, with the title citing 10 CVEs. On October 30 he described Starlet before 0.33 and Business::GoCardless before 1.01. Each visible excerpt stops mid-issue, so full CVE lists and some flaw details are not in these reports.
- HTTP::Body before 1.23_01: memory exhaustion, leftover temp files, quadratic CPU.
- That post’s title instead says nine CVEs and versions before 1.24_01.
- MIME-tools 5.521 covers hidden Content-Type parameters; the title cites 10 CVEs.
- Starlet before 0.33: large Content-Length can kill a worker; chunked bodies from 0.20.
- Business::GoCardless before 1.01: empty secrets accept forged webhooks.
Timeline
dated events in the reporting · oldest first- Oct 28, 2026HTTP::Body flaws posted on oss-security · oss-security
- Oct 28, 2026MIME-tools flaws posted on oss-security · oss-security
- Oct 30, 2026Starlet flaws posted on oss-security · oss-security
- Oct 30, 2026Business::GoCardless flaws posted on oss-security · oss-security
What each outlet adds
beyond the shared facts- oss-securityFour truncated Rothenberg posts on different Perl modules and fixed versions
- CVEs
- CVE-2026-116264CVE-2026-116265CVE-2026-116266CVE-2026-115865CVE-2026-115866CVE-2026-116127CVE-2026-116131CVE-2026-116132CVE-2026-116133CVE-2026-119036CVE-2026-119037CVE-2026-119038
Coverage
oldest first · one row per article · UTC- · 14d ago
oss-securityFirst report
Perl HTTP::Body before 1.23_01 allows resource exhaustion
Three named flaws cover unlimited form parts, leftover multipart temp files, and quadratic CPU use; the note is cut off.
- · 14d ago
MIME-tools before 5.521 for Perl fixes 10 CVEs
The visible flaws let one bad Content-Type parameter hide later parameters, including a multipart boundary.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-116127+2 related CVEs | HTTP response desync in Starlet before 0.33 | 9.1 group max | — | ||
CVE-2026-116132+1 related CVE | Temp-file leak in Perl HTTP::Body before 1.23_01 | 7.1 group max | — | ||
| CVE-2026-116133 | CPU exhaustion in Perl HTTP::Body before 1.23_01 | 7.5 | — | ||
| CVE-2026-116264 | Hidden multipart boundary in Perl MIME::Field::ParamVal before 5.521 | 5.3 | — | ||
| CVE-2026-116265 | Unflagged multipart boundary ambiguity in Perl MIME::Field::ParamVal | 5.3 | — | ||
| CVE-2026-116266 | Ambiguous multipart boundary parsing in Perl MIME::Head | 5.3 | — | ||
CVE-2026-119036+1 related CVE | Memory exhaustion in Business::GoCardless before 1.01 | 7.5 | — | ||
| CVE-2026-119038 | Missing session check in Perl Business::GoCardless before 1.01 | 6.1 | — |