Memory Exhaustion Vulnerability in Perl's HTTP::Body Product by CPAN

CVE-2026-116134

What is CVE-2026-116134?

A vulnerability in HTTP::Body versions prior to 1.23_01 allows attackers to exhaust server memory through an unbounded multipart part header block. This occurs because the multipart parser accepts part headers without a size limit, storing each line in memory. A remote attacker can exploit this by sending requests with large multipart headers, leading to potential service disruption and making it essential for administrators to apply patches to mitigate risks.

References