CVE-2026-116134: HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart part header block
HTTP::Body versions before 1.2301 for Perl allow memory exhaustion via an unbounded multipart part header block.
The multipart parser takes everything up to the first blank line after a boundary as the part's header block, with no limit on its size or number of lines. Every line is stored in the part's header hash, so a block of short lines costs about 60 bytes of memory per input byte.
A remote attacker can exhaust worker memory with a single request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HTTP::Bodyto a version that resolves this vulnerability.Fixed in 1.23_01
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the Perl CPAN package HTTP::Body at versions before 1.23_01 are affected when they parse multipart request bodies. The issue can exhaust memory in workers handling such requests.
What does an attacker need to exploit it?
A remote attacker needs to send a multipart request containing a part whose header block has no practical size or line-count bound before its first blank line. A single crafted request can exhaust worker memory.
What is the practical mitigation if an upgrade cannot be applied immediately?
The provided information identifies no temporary configuration workaround. Reduce exposure by preventing untrusted multipart requests from reaching affected HTTP::Body parsing workers until upgrading to a version that includes the fix.