{"id":"CVE-2026-116531","kind":"vulnerability","aliases":["CVE-2026-116531"],"related":[],"title":"Perl HTTP::Body: chunked request parsing can hang or smuggle requests","description":"HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk.\n\nIn chunked mode, used when no content length is given, add() treats a chunk as complete once the buffer is as long as the chunk's declared size, but the buffer still holds the chunk-size line. When a read ends in the last bytes of a chunk, add() takes the chunk short and parses the leftover data as the next chunk-size line.\n\nA remote attacker can make a chunked body never complete, hanging a server that reads until the body is done, and may make it complete early, leaving the remaining bytes to be read as the next request.","summary":"HTTP::Body for Perl mishandles chunk boundaries in chunked request bodies when a read ends inside a chunk. A remote attacker can make a body never complete, hanging a server, or make it complete early so leftover bytes are parsed as a second request.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["http-body","package","perl","self-hosted"],"not_affected_if":["content-length-only","no-perl-http-body"],"how_to_check":"- Check the installed HTTP::Body version with `perl -MHTTP::Body -e 'print $HTTP::Body::VERSION'`\n- Look for HTTP::Body in the cpanfile, Makefile.PL or lockfile of Perl web applications\n- unknown whether the sources list other checks","fix":"- Upgrade HTTP::Body to `1.23_01` or later\n- unknown whether the sources name a fixed release beyond this version","status":"open","published_at":"2026-10-28T18:17:14+00:00","first_seen_at":"2026-10-28T18:34:33+00:00","triaged_at":"2026-10-28T18:35:19+00:00","updated_at":"2026-10-28T18:35:19+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-28T18:35:19Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade HTTP::Body to `1.23_01` or later\n- unknown whether the sources name a fixed release beyond this version","reach":"internet","title":"Perl HTTP::Body: chunked request parsing can hang or smuggle requests","impact":"medium","summary":"HTTP::Body for Perl mishandles chunk boundaries in chunked request bodies when a read ends inside a chunk. A remote attacker can make a body never complete, hanging a server, or make it complete early so leftover bytes are parsed as a second request.","category":"package","nicknames":[],"who_cares":["perl","http-body","self-hosted"],"confidence":0.5,"needs_auth":"no","worst_case":"Server hangs on request or a second request is smuggled through","analyst_note":"Check the NVD entry and the HTTP::Body changelog for exact affected range and whether a server or framework must be configured to reach the chunked path.","how_to_check":"- Check the installed HTTP::Body version with `perl -MHTTP::Body -e 'print $HTTP::Body::VERSION'`\n- Look for HTTP::Body in the cpanfile, Makefile.PL or lockfile of Perl web applications\n- unknown whether the sources list other checks","needs_analyst":true,"not_affected_if":["no-perl-http-body","content-length-only"],"who_is_affected":"Perl applications that parse chunked request bodies with HTTP::Body, typically through a web framework or server that uses it for request parsing. Requests without a Content-Length header take the chunked path. Applications that do not use HTTP::Body for request bodies are unlikely to be affected; the sources do not say more.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000647,"input_tokens":3431,"output_tokens":608,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-116531':14A,17A '-2026':13A,16A '01':75C '1.23':74C 'add':104C,143C 'attack':46B,162C 'bodi':3A,20B,27B,36B,50B,71C,86C,167C,177C 'boundari':32B,82C 'buffer':112C,124C 'byte':63B,139C,189C 'chunk':4A,31B,34B,43B,81C,84C,93C,95C,107C,118C,129C,142C,146C,157C,166C 'chunk-siz':128C,156C 'complet':52B,59B,109C,169C,184C 'content':100C 'cve':12A,15A 'data':152C 'declar':120C 'done':179C 'earli':60B,185C 'end':40B,90C,135C 'given':103C 'hang':8A,53B,170C 'hold':126C 'host':25B 'http':2A,19B,26B,70C 'http-bodi':18B 'insid':41B,91C 'last':138C 'leav':186C 'leftov':62B,151C 'length':101C 'line':131C,159C 'long':115C 'lose':78C 'make':48B,57B,164C,182C 'may':181C 'mishandl':30B 'mode':96C 'never':51B,168C 'next':155C,195C 'packag':21B 'pars':6A,65B,149C 'perl':1A,22B,29B,77C 'read':39B,89C,134C,174C,192C 'remain':188C 'remot':45B,161C 'request':5A,11A,35B,69B,85C,196C 'second':68B 'self':24B 'self-host':23B 'server':55B,172C 'short':147C 'size':121C,130C,158C 'smuggl':10A 'still':125C 'take':144C 'track':79C 'treat':105C 'use':97C 'version':72C","nicknames":[],"mitigations":[],"who_affected":"Perl applications that parse chunked request bodies with HTTP::Body, typically through a web framework or server that uses it for request parsing. Requests without a Content-Length header take the chunked path. Applications that do not use HTTP::Body for request bodies are unlikely to be affected; the sources do not say more.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T18:17:14+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116531","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116531","severity":null,"published_at":"2026-10-28T18:17:14+00:00","modified_at":"2026-10-28T18:17:14+00:00","first_seen_at":"2026-10-28T18:34:33+00:00","fetched_at":"2026-10-28T18:34:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}