Memory and File Exhaustion Vulnerability in HTTP::Body for Perl

CVE-2026-116131

What is CVE-2026-116131?

The HTTP::Body module for Perl, in versions prior to 1.23_01, is susceptible to a vulnerability that allows an attacker to exhaust server memory and create numerous temporary files. This is achieved through the unlimited handling of form fields and multipart parts. The urlencoded parser processes the entire body at once, using substantial memory for each separator which can lead to resource depletion. Similarly, the multipart parser generates temporary files for parts with filenames without imposing any limitations. A remote attacker can exploit this vulnerability by sending crafted requests containing a large number of separators or small file parts, thereby overwhelming server resources.

References