HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundary
Summary
| CVE | CVE-2026-116133 |
|---|---|
| State | PUBLISHED |
| Assigner | CPANSec |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-28 18:17:12 UTC |
| Updated | 2026-10-29 15:11:53 UTC |
| Description | HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundary. Before the first part, and between parts, the multipart parser searches the whole buffered body for the next boundary. On a miss it keeps everything and searches again from the start when the next chunk arrives. A body with no boundary, or with a delimiter followed by neither CRLF nor "--", is therefore rescanned on every chunk, taking time quadratic in its size. A remote attacker can exhaust worker CPU with a few such requests. |
Risk And Classification
EPSS: 0.003100000 probability, percentile 0.237890000 (date 2026-10-29)
Problem Types: CWE-407 | CWE-407 CWE-407 Inefficient Algorithmic Complexity
There are no known software configurations currently associated with this CVE in NVD or the CVE Program record.
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| metacpan.org/release/GETTY/HTTP-Body-1.24/changes | 9b29abf9-4ab0-4765-b253-1875cd9b441e | metacpan.org | |
| github.com/libwww-perl/HTTP-Body/commit/bf77eb959bbe1641b77f69eefe98d58c... | 9b29abf9-4ab0-4765-b253-1875cd9b441e | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
Solutions
CNA: Upgrade to HTTP-Body 1.23_01 or later.
There are currently no legacy QID mappings associated with this CVE.