CVE-2026-116131: HTTP::Body versions before 1.23_01 for Perl allow memory and temporary file exhaustion via an unlimited number of form fields and multipart parts
HTTP::Body versions before 1.2301 for Perl allow memory and temporary file exhaustion via an unlimited number of form fields and multipart parts.
The urlencoded parser splits the whole body on its separators at once, creating one scalar per separator before any field is stored. This costs about 90 bytes of memory per separator byte. The multipart parser creates a temporary file for every part that carries a filename. Neither parser limits how many fields or parts a body may hold.
A remote attacker can exhaust worker memory with a body made of separators, or create thousands of temporary files with one request of small file parts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HTTP::Bodyto a version that resolves this vulnerability.Fixed in 1.23_01
Event History
Frequently Asked Questions
What input must an attacker be able to send to exploit this issue?
The attacker needs to send a request body processed by HTTP::Body. Urlencoded bodies with many separators can consume worker memory, while multipart bodies containing many filename-bearing parts can create large numbers of temporary files.
Which deployments are realistically exposed?
Applications using HTTP::Body before 1.23_01 are exposed when they accept attacker-controlled form or multipart request bodies. The supplied information does not identify any configuration setting that disables the affected parsing behavior by default.
What can be done if upgrading is not immediately possible?
The provided data identifies the attack vectors but does not document a specific workaround. Reduce exposure by preventing untrusted requests from reaching the affected form and multipart parsing paths where operationally possible.
How can I determine whether an instance is affected?
Check the installed HTTP::Body version. Versions before 1.23_01 are affected; the referenced change information includes HTTP-Body 1.24.