UBUNTU-CVE-2026-116132: Medium severity ubuntu/libhttp-body-perl vulnerability
HTTP::Body versions before 1.2301 for Perl leave the temporary file of an incomplete multipart upload on disk. The multipart parser creates a temporary file as soon as a file part starts, but adds it to the upload list only when the part completes. Uploads are only ever deleted from that list, by the cleanup option or by the caller, so a body that ends inside a file part leaves its temporary file where nothing can find it. A remote attacker can fill the temporary directory by repeating such requests, leaving one file behind for each.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HTTP::Bodyto a version that resolves this vulnerability.Fixed in 1.23_01
Event History
Frequently Asked Questions
What does an attacker need to send to trigger the issue?
The attacker needs to send multipart upload requests whose body ends while a file part is still incomplete. Each such request can leave behind one temporary file.
Who is exposed to remote exploitation?
Any deployment using an affected HTTP::Body version that accepts remote multipart uploads is exposed. The attacker does not need to complete the upload for the temporary file to remain on disk.
How can I check for exposure or impact?
Check the installed HTTP::Body version: versions before 1.23_01 are affected. On impacted systems, repeated incomplete multipart uploads may result in temporary files accumulating in the configured temporary directory.