Memory Exhaustion in HTTP::Body by Perl
CVE-2026-117501
What is CVE-2026-117501?
The HTTP::Body library for Perl has a vulnerability that allows for memory exhaustion through unbounded buffering when processing chunked request bodies. When no content length is specified, the add() function retains each chunk in memory until the entire request body is received. If the input does not conform to the expected format—such as non-chunk-size lines, improperly formatted size lines, or excessively large size headers—the parser may become unresponsive, leading to significant memory usage as each subsequent add() increases the buffer size. Attackers can exploit this flaw, causing applications that utilize HTTP::Body to consume excessive amounts of memory, potentially leading to Denial of Service (DoS). Users are encouraged to upgrade to the patched version to mitigate these risks.