CVE-2026-116131

HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. The parser can wait indefinitely for a valid chunk-size line while each add() grows the buffer.

HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload. A basename made of many dots ending in a backslash causes quadratic matching time.

HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk. This can make a body never complete, hanging the server, or complete early, leaving leftover bytes to be read as the next request.

HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. Matching a chunk-size line can take quadratic time in its length, with no limit on line length.

HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them. The decode table holds only the all-lowercase and all-uppercase spelling of each hex pair, while the escape pattern matches either case. An escape such as %aB finds no entry and is replaced with nothing, joining the bytes on either side.

HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart part header block. The multipart parser takes everything up to the first blank line after a boundary as the part's header block, with no limit on its size or number of lines. Every line is stored in the part's header hash, so a block of short lines costs about 60 bytes of memory per input byte.

HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundary. Before the first part, and between parts, the multipart parser searches the whole buffered body for the next boundary. On a miss it keeps everything and searches again from the start when the next chunk arrives, so a body with no boundary, or with a delimiter followed by neither CRLF nor "--", is rescanned on every chunk, taking time quadratic in its size.

A vulnerability in the HTTP::Body Perl library (versions before 1.23_01) leaves temporary files from incomplete multipart uploads on disk. The multipart parser creates a temporary file as soon as a file part starts but only adds it to the upload list when the part completes, so an upload that ends inside a file part leaves its temporary file where nothing can find it.