Live › vulnerability › CVE-2026-116134
Go to dashboardHTTP::Body, a Perl module that parses HTTP request bodies, reads every line of a multipart part's header block with no size limit, storing each in memory. A remote attacker can send one crafted request that exhausts the worker's memory and crashes or stalls it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 18:34 UTC. All times on this page are UTC.
Perl web applications that parse multipart/form-data request bodies with HTTP::Body below 1.23_01, typically through frameworks built on it such as Catalyst or Plack. Services that never accept multipart uploads or sit behind a proxy that caps request size are less exposed. unknown whether the sources list specific frameworks.
No product ranges from the sources yet.
cpanm --info HTTP::Body or perl -MHTTP::Body -e 'print $HTTP::Body::VERSION' to read the installed versioncpanfile.snapshot for HTTP::Body1.23_01 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart part header block.
The multipart parser takes everything up to the first blank line after a boundary as the part's header block, with no limit on its size or number of lines. Every line is stored in the part's header hash, so a block of short lines costs about 60 bytes of memory per input byte.
A remote attacker can exhaust worker memory with a single request.
This page as .md · .json · in your agent: get_signal("CVE-2026-116134")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.