{"id":"CVE-2026-117500","kind":"vulnerability","aliases":["CVE-2026-117500"],"related":[],"title":"HTTP::Body (Perl): crafted multipart filename causes CPU exhaustion via regex","description":"HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload.\n\nFor every file part, the multipart parser finds the suffix of the uploaded filename by matching the default $basename_regexp, qr/[^.]+(\\.[^\\\\\\/]+)$/, against the whole basename. A basename made of many dots and ending in a backslash makes the regex backtrack in time quadratic in its length.\n\nA remote attacker can exhaust CPU with one request, as a basename of about 32 KB takes several seconds to match and every file part is matched separately.","summary":"HTTP::Body, a Perl module that parses multipart form uploads, runs a regular expression over each uploaded filename that backtracks heavily on filenames made of many dots ending in a backslash. A remote attacker can send one request with a filename of about 32 KB and tie up CPU for several seconds.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["http-body","package","perl","web-apps"],"not_affected_if":["no-multipart-uploads","not-using-http-body"],"how_to_check":"- Run `perl -MHTTP::Body -e 'print $HTTP::Body::VERSION'` or `cpanm --info HTTP::Body` to read the installed version\n- Check `cpanm --info HTTP::Body` or the lockfile for `HTTP::Body` below `1.24_01`","fix":"- Upgrade HTTP::Body to `1.24_01` or later, as the fixed release named in the advisory\n- Rebuild or redeploy Perl applications after the upgrade so the new module is loaded","status":"open","published_at":"2026-10-28T18:17:14+00:00","first_seen_at":"2026-10-28T18:34:33+00:00","triaged_at":"2026-10-28T18:35:18+00:00","updated_at":"2026-10-28T18:35:18+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T18:35:18Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade HTTP::Body to `1.24_01` or later, as the fixed release named in the advisory\n- Rebuild or redeploy Perl applications after the upgrade so the new module is loaded","reach":"internet","title":"HTTP::Body (Perl): crafted multipart filename causes CPU exhaustion via regex","impact":"medium","summary":"HTTP::Body, a Perl module that parses multipart form uploads, runs a regular expression over each uploaded filename that backtracks heavily on filenames made of many dots ending in a backslash. A remote attacker can send one request with a filename of about 32 KB and tie up CPU for several seconds.","category":"package","nicknames":[],"who_cares":["perl","http-body","web-apps"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker exhausts CPU on the server with single requests","analyst_note":"Confirm the fixed version and whether any framework bundles HTTP::Body; the NVD entry does not list affected version ranges beyond the 1.24_01 boundary.","how_to_check":"- Run `perl -MHTTP::Body -e 'print $HTTP::Body::VERSION'` or `cpanm --info HTTP::Body` to read the installed version\n- Check `cpanm --info HTTP::Body` or the lockfile for `HTTP::Body` below `1.24_01`","needs_analyst":true,"not_affected_if":["no-multipart-uploads","not-using-http-body"],"who_is_affected":"Applications that use HTTP::Body directly or through a framework to parse multipart uploads on a public endpoint are exposed, since any file part triggers the regex. Internal tools that accept no untrusted uploads have little exposure. Services that do not parse multipart bodies with this module can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000669,"input_tokens":3419,"output_tokens":655,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117500':14A,17A '-2026':13A,16A '01':83C '1.24':82C '32':69B,159C 'allow':86C 'app':25B 'attack':59B,147C 'backslash':56B,134C 'backtrack':45B,91C,138C 'basenam':117C,123C,125C,156C 'bodi':2A,20B,27B,79C 'caus':7A 'cpu':8A,74B,87C,150C 'craft':4A 'cve':12A,15A 'default':116C 'dot':52B,129C 'end':53B,131C 'everi':100C,167C 'exhaust':9A,88C,149C 'express':39B 'file':101C,168C 'filenam':6A,43B,48B,66B,94C,112C 'find':106C 'form':34B 'heavili':46B 'http':1A,19B,26B,78C 'http-bodi':18B 'kb':70B,160C 'length':144C 'made':49B,126C 'make':135C 'mani':51B,128C 'match':114C,165C,171C 'modul':30B 'multipart':5A,33B,97C,104C 'one':62B,152C 'packag':21B 'pars':32B 'parser':105C 'part':102C,169C 'perl':3A,22B,29B,85C 'qr':119C 'quadrat':141C 'regex':11A,90C,137C 'regexp':118C 'regular':38B 'remot':58B,146C 'request':63B,153C 'run':36B 'second':77B,163C 'send':61B 'separ':172C 'sever':76B,162C 'suffix':108C 'take':161C 'tie':72B 'time':140C 'upload':35B,42B,98C,111C 'version':80C 'via':10A,89C 'web':24B 'web-app':23B 'whole':122C","nicknames":[],"mitigations":[],"who_affected":"Applications that use HTTP::Body directly or through a framework to parse multipart uploads on a public endpoint are exposed, since any file part triggers the regex. Internal tools that accept no untrusted uploads have little exposure. Services that do not parse multipart bodies with this module can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T18:17:14+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117500","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117500","severity":null,"published_at":"2026-10-28T18:17:14+00:00","modified_at":"2026-10-28T18:17:14+00:00","first_seen_at":"2026-10-28T18:34:33+00:00","fetched_at":"2026-10-28T18:34:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}