Perl HTTP::Body Vulnerability Allowing Remote CPU Exhaustion via Multipart Uploads

CVE-2026-117500

What is CVE-2026-117500?

Versions of the HTTP::Body module for Perl prior to 1.24_01 are susceptible to a vulnerability that allows remote attackers to cause substantial CPU exhaustion through crafted multipart uploads. This occurs when the library processes a filename with multiple dots, leading to excessive regex backtracking and time-consuming operations for each file part of the upload. Consequently, attackers can significantly degrade server performance with a single, specially designed request.

References