Live › vulnerability › CVE-2026-117500
Go to dashboardHTTP::Body, a Perl module that parses multipart form uploads, runs a regular expression over each uploaded filename that backtracks heavily on filenames made of many dots ending in a backslash. A remote attacker can send one request with a filename of about 32 KB and tie up CPU for several seconds.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 18:34 UTC. All times on this page are UTC.
Applications that use HTTP::Body directly or through a framework to parse multipart uploads on a public endpoint are exposed, since any file part triggers the regex. Internal tools that accept no untrusted uploads have little exposure. Services that do not parse multipart bodies with this module can skip it.
No product ranges from the sources yet.
perl -MHTTP::Body -e 'print $HTTP::Body::VERSION' or cpanm --info HTTP::Body to read the installed versioncpanm --info HTTP::Body or the lockfile for HTTP::Body below 1.24_011.24_01 or later, as the fixed release named in the advisoryEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload.
For every file part, the multipart parser finds the suffix of the uploaded filename by matching the default $basename_regexp, qr/[^.]+(.[^\/]+)$/, against the whole basename. A basename made of many dots and ending in a backslash makes the regex backtrack in time quadratic in its length.
A remote attacker can exhaust CPU with one request, as a basename of about 32 KB takes several seconds to match and every file part is matched separately.
This page as .md · .json · in your agent: get_signal("CVE-2026-117500")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.