UBUNTU-CVE-2026-117500: Medium severity ubuntu/libhttp-body-perl vulnerability
HTTP::Body versions before 1.2401 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload. For every file part, the multipart parser finds the suffix of the uploaded filename by matching the default $basenameregexp, qr/[^.]+(\.[^\\\/]+)$/, against the whole basename. A basename made of many dots and ending in a backslash makes the regex backtrack in time quadratic in its length. A remote attacker can exhaust CPU with one request, as a basename of about 32 KB takes several seconds to match and every file part is matched separately.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HTTP::Bodyto a version that resolves this vulnerability.Fixed in 1.24_01
Event History
Frequently Asked Questions
Is a non-default configuration required for exploitation?
No. The issue is in the default $basename_regexp used to find multipart upload filename suffixes in HTTP::Body versions before 1.24_01.
Which deployments are exposed to a remote attacker?
Deployments that parse multipart uploads with an affected HTTP::Body version are exposed when an attacker can submit a multipart request containing a crafted file filename. A single request can exhaust CPU.
Can an attacker increase the CPU cost within one request?
Yes. The filename match is performed separately for every file part, so multipart requests with multiple crafted file parts cause the expensive regex processing to be repeated.