CVE-2026-117500: vulnerability in HTTP-Body
HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.3%
HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload.
For every file part, the multipart parser finds the suffix of the uploaded filename by matching the default $basename_regexp, qr/[^.]+(\.[^\\\/]+)$/, against the whole basename. A basename made of many dots and ending in a backslash makes the regex backtrack in time quadratic in its length.
A remote attacker can exhaust CPU with one request, as a basename of about 32 KB takes several seconds to match and every file part is matched separately.
Affected products
HTTP-BodyRelated CVEs — HTTP-Body
In the same product, most dangerous first.
CVE-2026-116135—HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding themEPSS 0.3%CVE-2026-116132—HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on diskEPSS 0.3%CVE-2026-116134—HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart part header blockEPSS 0.3%CVE-2026-116133—HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundaryEPSS 0.3%CVE-2026-116131—HTTP::Body versions before 1.23_01 for Perl allow memory and temporary file exhaustion via an unlimited number of form fields and multipart partsEPSS 0.3%CVE-2026-116531—HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunkEPSS 0.3%