Performance Degradation in Perl HTTP::Body Affecting GETTY
CVE-2026-121006

Currently unrated

Key Information:

Status
Vendor
CVE Published:
6 November 2026

What is CVE-2026-121006?

The HTTP::Body component in versions prior to 1.24_02 for Perl exhibits a performance issue due to inefficient parsing of HTTP trailers, which can lead to significant CPU exhaustion. When a remote attacker sends a carefully crafted request, the processing time increases quadratically with the number of fields, causing the server to become unresponsive. In version 1.25, this vulnerability is mitigated by limiting the size and number of fields in the trailer, addressing the performance concerns.

References

https://metacpan.org/release/GETTY/HTTP-Body-1.24_02/changes
release-notes
https://github.com/libwww-perl/HTTP-Body/commit/983dd4ca3...
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.