CVE-2026-116132: HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk

Q: Who is exposed to this issue?

Applications using HTTP::Body before 1.23_01 that accept multipart uploads are exposed if an attacker can send requests that terminate during a file part. Each such incomplete request can leave a temporary file on disk.

Q: What does an attacker need to do to exploit it?

The attacker needs to submit multipart upload requests whose body ends before a file part completes. Repeating these requests can fill the temporary directory with orphaned temporary files.

Q: Is there a workaround if upgrading is not immediately possible?

No workaround is specified in the provided data. The described behavior can be limited operationally by monitoring and managing available space in the temporary directory, but the provided data does not identify an application-level mitigation.

Q: How can I tell whether I may be affected?

Check whether the application uses HTTP::Body before version 1.23_01 and processes multipart uploads. Orphaned temporary files following interrupted or malformed multipart file uploads are consistent with the described issue.

Published Oct 28, 2026

Updated

HTTP::Body versions before 1.2301 for Perl leave the temporary file of an incomplete multipart upload on disk.

The multipart parser creates a temporary file as soon as a file part starts, but adds it to the upload list only when the part completes. Uploads are only ever deleted from that list, by the cleanup option or by the caller, so a body that ends inside a file part leaves its temporary file where nothing can find it.

A remote attacker can fill the temporary directory by repeating such requests, leaving one file behind for each.

Affected Software

1 affected component

cpan/HTTP::Body<1.23_01

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade HTTP::Body to a version that resolves this vulnerability.
Fixed in 1.23_01

Event History

Oct 28, 2026

CVE Published

via MITRE·05:15 PM

Data Sourced

via MITRE·05:15 PM

RemedyDescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

Applications using HTTP::Body before 1.23_01 that accept multipart uploads are exposed if an attacker can send requests that terminate during a file part. Each such incomplete request can leave a temporary file on disk.

What does an attacker need to do to exploit it?

The attacker needs to submit multipart upload requests whose body ends before a file part completes. Repeating these requests can fill the temporary directory with orphaned temporary files.

Is there a workaround if upgrading is not immediately possible?

No workaround is specified in the provided data. The described behavior can be limited operationally by monitoring and managing available space in the temporary directory, but the provided data does not identify an application-level mitigation.

How can I tell whether I may be affected?

Check whether the application uses HTTP::Body before version 1.23_01 and processes multipart uploads. Orphaned temporary files following interrupted or malformed multipart file uploads are consistent with the described issue.

CVE-2026-116132: HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to exploit it?

Is there a workaround if upgrading is not immediately possible?

How can I tell whether I may be affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to exploit it?

Is there a workaround if upgrading is not immediately possible?

How can I tell whether I may be affected?