CVE-2026-116133: HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundary

Q: Which deployments are exposed to this denial-of-service issue?

Deployments using HTTP::Body for Perl versions before 1.23_01 are affected when they parse multipart request bodies. The issue can be triggered by multipart input that lacks a valid next boundary.

Q: What does an attacker need to send to trigger excessive CPU use?

An attacker can send a multipart body with no boundary, or a delimiter that is not followed by CRLF or "--". Delivering the body in chunks causes the parser to repeatedly rescan the buffered content from the start.

Q: Is authentication or a large number of requests required?

The available information describes this as remotely exploitable and states that a few malformed requests can exhaust worker CPU. It does not identify any authentication requirement.

Q: What version should be used to remediate the issue?

Upgrade HTTP::Body to version 1.23_01 or later. Version 1.24 is referenced in the provided release-change information.

Published Oct 28, 2026

Updated

HTTP::Body versions before 1.2301 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundary.

Before the first part, and between parts, the multipart parser searches the whole buffered body for the next boundary. On a miss it keeps everything and searches again from the start when the next chunk arrives. A body with no boundary, or with a delimiter followed by neither CRLF nor "--", is therefore rescanned on every chunk, taking time quadratic in its size.

A remote attacker can exhaust worker CPU with a few such requests.

Affected Software

1 affected component

cpan/HTTP-Body<1.23_01

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade HTTP::Body to a version that resolves this vulnerability.
Fixed in 1.23_01

Event History

Oct 28, 2026

CVE Published

via MITRE·05:15 PM

Data Sourced

via MITRE·05:15 PM

RemedyDescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

Deployments using HTTP::Body for Perl versions before 1.23_01 are affected when they parse multipart request bodies. The issue can be triggered by multipart input that lacks a valid next boundary.

What does an attacker need to send to trigger excessive CPU use?

An attacker can send a multipart body with no boundary, or a delimiter that is not followed by CRLF or "--". Delivering the body in chunks causes the parser to repeatedly rescan the buffered content from the start.

Is authentication or a large number of requests required?

The available information describes this as remotely exploitable and states that a few malformed requests can exhaust worker CPU. It does not identify any authentication requirement.

What version should be used to remediate the issue?

Upgrade HTTP::Body to version 1.23_01 or later. Version 1.24 is referenced in the provided release-change information.

CVE-2026-116133: HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundary

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

What does an attacker need to send to trigger excessive CPU use?

Is authentication or a large number of requests required?

What version should be used to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

What does an attacker need to send to trigger excessive CPU use?

Is authentication or a large number of requests required?

What version should be used to remediate the issue?