File Handling Vulnerability in HTTP::Body for Perl Applications
CVE-2026-116132

Currently unrated

Key Information:

Vendor

Perl

Status
Vendor
CVE Published:
28 October 2026

What is CVE-2026-116132?

The HTTP::Body module for Perl creates temporary files during multipart file uploads. However, if a file upload is incomplete, the temporary file remains on disk without proper cleanup. This can be exploited by remote attackers, who can repeatedly trigger incomplete uploads, leading to an accumulation of temporary files and subsequent disk space exhaustion. Users must ensure they update to patched versions to mitigate this vulnerability and prevent potential denial of service attacks.

References

https://rt.cpan.org/Public/Bug/Display.html?id=84004
issue-tracking
https://github.com/libwww-perl/HTTP-Body/commit/29e933b22...
patch
https://metacpan.org/release/GETTY/HTTP-Body-1.24/changes
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.