Buffer Mismanagement Vulnerability in HTTP::Body for Perl

CVE-2026-116531

What is CVE-2026-116531?

The HTTP::Body library for Perl, in versions prior to 1.23_01, is susceptible to a buffer mismanagement vulnerability when handling chunked request bodies. In scenarios where no content length is specified, the add() method can misinterpret the boundaries of chunks. Specifically, when a read occurs at the end of a chunk, the method may incorrectly process the chunk length, potentially leaving the server hanging while it awaits the completion of the request. This can result in erratic behavior where subsequent requests may be mishandled, allowing an attacker to exploit these parsing errors.

References