HTTP::Body vulnerabilities

HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. The parser can wait indefinitely for a valid chunk-size line while each add() grows the buffer.

HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload. A basename made of many dots ending in a backslash causes quadratic matching time.

HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk. This can make a body never complete, hanging the server, or complete early, leaving leftover bytes to be read as the next request.

HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. Matching a chunk-size line can take quadratic time in its length, with no limit on line length.

HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them. The decode table holds only the all-lowercase and all-uppercase spelling of each hex pair, while the escape pattern matches either case. An escape such as %aB finds no entry and is replaced with nothing, joining the bytes on either side.

HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart part header block. The multipart parser takes everything up to the first blank line after a boundary as the part's header block, with no limit on its size or number of lines. Every line is stored in the part's header hash, so a block of short lines costs about 60 bytes of memory per input byte.

HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundary. Before the first part, and between parts, the multipart parser searches the whole buffered body for the next boundary. On a miss it keeps everything and searches again from the start when the next chunk arrives, so a body with no boundary, or with a delimiter followed by neither CRLF nor "--", is rescanned on every chunk, taking time quadratic in its size.

A vulnerability in the HTTP::Body Perl library (versions before 1.23_01) leaves temporary files from incomplete multipart uploads on disk. The multipart parser creates a temporary file as soon as a file part starts but only adds it to the upload list when the part completes, so an upload that ends inside a file part leaves its temporary file where nothing can find it.

A vulnerability in the HTTP::Body Perl library (versions before 1.23_01) allows memory and temporary file exhaustion via an unlimited number of form fields and multipart parts. The urlencoded parser splits the entire body on its separators at once, costing about 90 bytes of memory per separator byte, and the multipart parser creates a temporary file for every part that carries a filename, with neither parser limiting the number of fields or parts.