{"id":"CVE-2026-116285","kind":"vulnerability","aliases":["CVE-2026-116285"],"related":[],"title":"HTTP::Body for Perl: chunked request parsing lets remote clients exhaust CPU","description":"HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies.\n\nIn chunked mode, used when no content length is given, add() matches each chunk-size line with `/^([\\da-fA-F]+).*\\x0D\\x0A/`. On a line of hex digits whose first LF has no CR before it, the digits and `.*` backtrack against each other, so a single add() takes time quadratic in the line's length. Nothing limits how long the line can be.\n\nA remote attacker can exhaust CPU in applications that pass chunked request bodies to HTTP::Body.","summary":"HTTP::Body before 1.23_01 uses a regex to read chunk-size lines in chunked request bodies, and that regex backtracks quadratically on long lines of hex digits without a CR before the LF. A remote attacker can send such a request to make the application spend a lot of CPU, causing denial of service.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["http-body","package","perl","self-hosted","web-apps"],"not_affected_if":["no-chunked-requests","no-http-body"],"how_to_check":"- Check the installed HTTP::Body version with `perl -MHTTP::Body -e 'print $HTTP::Body::VERSION'` or `cpanm --info HTTP::Body`\n- Look for HTTP::Body in the dependency tree with `cpan -l | grep HTTP::Body` or your lockfile\n- Confirm whether the application parses chunked request bodies through HTTP::Body (for example, requests without a Content-Length)","fix":"- Upgrade HTTP::Body to `1.23_01` or later\n- Rebuild or redeploy applications that bundle HTTP::Body so the new version is used","status":"open","published_at":"2026-10-28T18:17:13+00:00","first_seen_at":"2026-10-28T18:34:33+00:00","triaged_at":"2026-10-28T18:35:21+00:00","updated_at":"2026-10-28T18:35:21+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T18:35:21Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade HTTP::Body to `1.23_01` or later\n- Rebuild or redeploy applications that bundle HTTP::Body so the new version is used","reach":"internet","title":"HTTP::Body for Perl: chunked request parsing lets remote clients exhaust CPU","impact":"low","summary":"HTTP::Body before 1.23_01 uses a regex to read chunk-size lines in chunked request bodies, and that regex backtracks quadratically on long lines of hex digits without a CR before the LF. A remote attacker can send such a request to make the application spend a lot of CPU, causing denial of service.","category":"package","nicknames":[],"who_cares":["perl","http-body","web-apps","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Remote clients can exhaust server CPU and stall request handling","analyst_note":"Check the NVD entry and the HTTP::Body Changes file for the exact fixed version and whether a default configuration accepts chunked bodies.","how_to_check":"- Check the installed HTTP::Body version with `perl -MHTTP::Body -e 'print $HTTP::Body::VERSION'` or `cpanm --info HTTP::Body`\n- Look for HTTP::Body in the dependency tree with `cpan -l | grep HTTP::Body` or your lockfile\n- Confirm whether the application parses chunked request bodies through HTTP::Body (for example, requests without a Content-Length)","needs_analyst":true,"not_affected_if":["no-http-body","no-chunked-requests"],"who_is_affected":"Perl applications that parse request bodies with HTTP::Body, such as web apps and frameworks built on it, are exposed when they accept chunked request bodies (no Content-Length header). Systems that do not use HTTP::Body, or that reject chunked requests before they reach it, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000687,"input_tokens":3431,"output_tokens":688,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-116285':15A,18A '-2026':14A,17A '01':34B,91C '1.23':33B,90C 'add':116C,154C 'allow':94C 'app':29B 'applic':76B,178C 'attack':67B,173C 'backtrack':51B,100C,147C 'bodi':2A,21B,31B,47B,87C,105C,183C,186C 'caus':82B 'chunk':5A,41B,45B,103C,107C,120C,181C 'chunk-siz':40B,119C 'client':10A 'content':112C 'cpu':12A,81B,95C,176C 'cr':61B,141C 'cve':13A,16A 'da':125C 'da-fa-f':124C 'denial':83B 'digit':58B,135C,145C 'exhaust':11A,96C,175C 'f':127C 'fa':126C 'first':137C 'given':115C 'hex':57B,134C 'host':26B 'http':1A,20B,30B,86C,185C 'http-bodi':19B 'length':113C,162C 'let':8A 'lf':64B,138C 'limit':164C 'line':43B,55B,122C,132C,160C,168C 'long':54B,166C 'lot':79B 'make':74B 'match':117C 'mode':108C 'noth':163C 'packag':22B 'pars':7A,102C 'pass':180C 'perl':4A,23B,93C 'quadrat':52B,98C,157C 'read':39B 'regex':37B,50B,99C 'remot':9A,66B,172C 'request':6A,46B,72B,104C,182C 'self':25B 'self-host':24B 'send':69B 'servic':85B 'singl':153C 'size':42B,121C 'spend':77B 'take':155C 'time':156C 'use':35B,109C 'version':88C 'via':97C 'web':28B 'web-app':27B 'whose':136C 'without':59B 'x0a':129C 'x0d':128C","nicknames":[],"mitigations":[],"who_affected":"Perl applications that parse request bodies with HTTP::Body, such as web apps and frameworks built on it, are exposed when they accept chunked request bodies (no Content-Length header). Systems that do not use HTTP::Body, or that reject chunked requests before they reach it, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T18:17:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116285","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116285","severity":null,"published_at":"2026-10-28T18:17:13+00:00","modified_at":"2026-10-28T18:17:13+00:00","first_seen_at":"2026-10-28T18:34:33+00:00","fetched_at":"2026-10-28T18:34:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}