Live › vulnerability › CVE-2026-117501
Go to dashboardHTTP::Body, a Perl module for parsing HTTP request bodies, buffers chunked uploads without limit when a chunk line is malformed or never completes. A remote attacker can keep sending data and drive the process into memory exhaustion, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 18:34 UTC. All times on this page are UTC.
Perl applications that parse incoming HTTP request bodies with HTTP::Body, typically through a web framework or PSGI stack, are exposed when clients can send chunked requests without Content-Length. Applications that do not use HTTP::Body, or that sit behind a proxy which buffers and limits request bodies, are less exposed.
No product ranges from the sources yet.
cpanm --info HTTP::Body or perl -MHTTP::Body -e 'print $HTTP::Body::VERSION' to read the installed version.HTTP::Body to see whether an application pulls it in.1.24_01 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies.
In chunked mode, used when no content length is given, add() holds each chunk in memory until all of it has arrived. A line that is not a chunk-size line, a size line without CRLF, or a size too large to fit an integer leaves the parser waiting forever, and every later add() grows the buffer.
A remote attacker can exhaust memory in applications that pass chunked request bodies to HTTP::Body.
This page as .md · .json · in your agent: get_signal("CVE-2026-117501")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.