UBUNTU-CVE-2026-117501: Medium severity ubuntu/libhttp-body-perl vulnerability
HTTP::Body versions before 1.2401 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. In chunked mode, used when no content length is given, add() holds each chunk in memory until all of it has arrived. A line that is not a chunk-size line, a size line without CRLF, or a size too large to fit an integer leaves the parser waiting forever, and every later add() grows the buffer. A remote attacker can exhaust memory in applications that pass chunked request bodies to HTTP::Body.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HTTP::Bodyto a version that resolves this vulnerability.Fixed in 1.24_01
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using HTTP::Body before 1.24_01 are exposed when they pass chunked HTTP request bodies to the library. Chunked mode is used when the request does not provide a Content-Length header.
What does an attacker need to do to trigger memory exhaustion?
A remote attacker must send a chunked request body that causes the parser to wait indefinitely, such as a non-chunk-size line, a chunk-size line without CRLF, or a size too large to fit an integer. Subsequent data supplied through add() is then retained in memory and can exhaust it.
Is a Content-Length request affected?
The described unbounded buffering behavior applies to chunked mode, which is used when no Content-Length is given. The provided information does not identify the same behavior for requests with Content-Length.
How can I determine whether my deployment is affected?
Check whether the application uses HTTP::Body and whether its version is earlier than 1.24_01. Then determine whether the application passes incoming chunked request bodies to HTTP::Body.