CVE-2026-116285: fallo de gravedad alta en HTTP-Body
HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.5epss 0.3%
HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies.
In chunked mode, used when no content length is given, add() matches each chunk-size line with `/^([\da-fA-F]+).*\x0D\x0A/`. On a line of hex digits whose first LF has no CR before it, the digits and `.*` backtrack against each other, so a single add() takes time quadratic in the line's length. Nothing limits how long the line can be.
A remote attacker can exhaust CPU in applications that pass chunked request bodies to HTTP::Body.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
HTTP-BodyCVEs relacionadas — HTTP-Body
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-116135CRITICALHTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding themEPSS 0.3%CVE-2026-116132HIGHHTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on diskEPSS 0.3%CVE-2026-116134HIGHHTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart part header blockEPSS 0.3%CVE-2026-116133HIGHHTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundaryEPSS 0.3%CVE-2026-116131MEDIUMHTTP::Body versions before 1.23_01 for Perl allow memory and temporary file exhaustion via an unlimited number of form fields and multipart partsEPSS 0.3%CVE-2026-116531CRITICALHTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunkEPSS 0.3%