Perl HTTP::Body Vulnerability in Multiple Versions by Perl
CVE-2026-116133

Currently unrated

Key Information:

Vendor

Perl

Status
Vendor
CVE Published:
28 October 2026

What is CVE-2026-116133?

The vulnerability in Perl's HTTP::Body allows a remote attacker to exploit the multipart parser, which can lead to CPU exhaustion. This occurs due to insufficient handling of malformed boundaries in multipart bodies, causing excessive rescanning of the entire buffered body. If a boundary is missing or incorrectly formatted, the parser will continuously re-scan, consuming significant CPU resources as each chunk is processed. A few specially crafted requests can lead to denial of service for the affected application, making it critical for users to update to version 1.23_01 or later to mitigate this risk.

References

https://github.com/libwww-perl/HTTP-Body/commit/bf77eb959...
patch
https://metacpan.org/release/GETTY/HTTP-Body-1.24/changes
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.