UBUNTU-CVE-2026-116285: Medium severity ubuntu/libhttp-body-perl vulnerability
HTTP::Body versions before 1.2301 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. In chunked mode, used when no content length is given, add() matches each chunk-size line with /^([\da-fA-F]+).\x0D\x0A/. On a line of hex digits whose first LF has no CR before it, the digits and . backtrack against each other, so a single add() takes time quadratic in the line's length. Nothing limits how long the line can be. A remote attacker can exhaust CPU in applications that pass chunked request bodies to HTTP::Body.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HTTP::Bodyto a version that resolves this vulnerability.Fixed in 1.23_01
Event History
Frequently Asked Questions
Which deployments are exposed to this CPU-exhaustion issue?
Applications are exposed if they use a vulnerable HTTP::Body version and pass chunked HTTP request bodies to it. Chunked mode is used when no Content-Length is provided.
What does an attacker need to send to trigger the expensive parsing behavior?
An attacker needs to provide a chunked request body containing a very long chunk-size line made of hexadecimal digits where the first LF is not preceded by a CR. There is no stated limit on the line length, and processing a single add() call can take quadratic time.
Are requests with a Content-Length affected?
The described vulnerable parsing path is chunked mode, which is used when no Content-Length is given. The provided information does not indicate that requests with Content-Length use this path.
How can I determine whether an application is affected?
Check whether the application uses HTTP::Body before version 1.23_01 and accepts or forwards chunked request bodies into HTTP::Body. Systems that do not pass chunked bodies to the library are not described as exposed by this issue.