UBUNTU-CVE-2026-116531: Medium severity ubuntu/libhttp-body-perl vulnerability
HTTP::Body versions before 1.2301 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk. In chunked mode, used when no content length is given, add() treats a chunk as complete once the buffer is as long as the chunk's declared size, but the buffer still holds the chunk-size line. When a read ends in the last bytes of a chunk, add() takes the chunk short and parses the leftover data as the next chunk-size line. A remote attacker can make a chunked body never complete, hanging a server that reads until the body is done, and may make it complete early, leaving the remaining bytes to be read as the next request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HTTP::Bodyto a version that resolves this vulnerability.Fixed in 1.23_01
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using HTTP::Body versions earlier than 1.23_01 are affected when they process chunked HTTP request bodies. Chunked mode is used when no Content-Length is supplied.
What does an attacker need to do to trigger the problem?
A remote attacker needs to send a crafted chunked request body such that a read ends in the last bytes of a chunk. The flawed boundary handling can then cause the body parser to misinterpret remaining data.
What is the practical impact on an affected server?
A server that reads until the request body is complete can hang because the body never completes. In some cases, the body may complete early and remaining bytes may be treated as the next request.