CVE-2026-116285: HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies

Q: Which applications are exposed to this issue?

Applications using HTTP::Body before 1.23_01 are exposed if they pass chunked HTTP request bodies to the library. Chunked mode is used when no Content-Length is provided.

Q: What does an attacker need to send to trigger the CPU exhaustion?

An attacker needs to provide a chunked request body containing a long chunk-size line made of hexadecimal digits where the first LF has no preceding CR. Processing that line in a single add() call can take quadratic time, and the line length is not limited.

Q: Is authentication or local access required to exploit this?

No. The issue can be triggered remotely by an attacker able to send a crafted chunked request body to an affected application.

Q: What should be done if an immediate upgrade is not possible?

The provided data identifies unbounded chunk-size line length as the condition that enables the expensive parsing behavior. Limit or reject oversized chunk-size lines before they are passed to HTTP::Body, where that is feasible.

Published Oct 28, 2026

Updated

HTTP::Body versions before 1.2301 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies.

In chunked mode, used when no content length is given, add() matches each chunk-size line with /^([\da-fA-F]+).\x0D\x0A/. On a line of hex digits whose first LF has no CR before it, the digits and . backtrack against each other, so a single add() takes time quadratic in the line's length. Nothing limits how long the line can be.

A remote attacker can exhaust CPU in applications that pass chunked request bodies to HTTP::Body.

Affected Software

1 affected component

cpan/HTTP::Body<1.23_01

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade HTTP::Body to a version that resolves this vulnerability.
Fixed in 1.23_01

Event History

Oct 28, 2026

CVE Published

via MITRE·05:16 PM

Data Sourced

via MITRE·05:16 PM

RemedyDescriptionWeakness

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using HTTP::Body before 1.23_01 are exposed if they pass chunked HTTP request bodies to the library. Chunked mode is used when no Content-Length is provided.

What does an attacker need to send to trigger the CPU exhaustion?

An attacker needs to provide a chunked request body containing a long chunk-size line made of hexadecimal digits where the first LF has no preceding CR. Processing that line in a single add() call can take quadratic time, and the line length is not limited.

Is authentication or local access required to exploit this?

No. The issue can be triggered remotely by an attacker able to send a crafted chunked request body to an affected application.

What should be done if an immediate upgrade is not possible?

The provided data identifies unbounded chunk-size line length as the condition that enables the expensive parsing behavior. Limit or reject oversized chunk-size lines before they are passed to HTTP::Body, where that is feasible.

CVE-2026-116285: HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to send to trigger the CPU exhaustion?

Is authentication or local access required to exploit this?

What should be done if an immediate upgrade is not possible?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What does an attacker need to send to trigger the CPU exhaustion?

Is authentication or local access required to exploit this?

What should be done if an immediate upgrade is not possible?