Perl HTTP::Body Vulnerability Leading to CPU Exhaustion in Applications

CVE-2026-116285

What is CVE-2026-116285?

A vulnerability in HTTP::Body versions prior to 1.23_01 allows remote attackers to cause CPU exhaustion through quadratic regex backtracking while parsing chunked request bodies. In chunked transfer mode, the add() method matches chunk-size lines with regex, and an exploitable scenario arises when there is improper handling of hex digit lines. This can lead to significant performance degradation in applications that process chunked requests, making them susceptible to denial-of-service conditions.

References