{"id":"CVE-2026-117501","kind":"vulnerability","aliases":["CVE-2026-117501"],"related":[],"title":"Perl HTTP::Body: chunked request bodies exhaust server memory","description":"HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies.\n\nIn chunked mode, used when no content length is given, add() holds each chunk in memory until all of it has arrived. A line that is not a chunk-size line, a size line without CRLF, or a size too large to fit an integer leaves the parser waiting forever, and every later add() grows the buffer.\n\nA remote attacker can exhaust memory in applications that pass chunked request bodies to HTTP::Body.","summary":"HTTP::Body, a Perl module for parsing HTTP request bodies, buffers chunked uploads without limit when a chunk line is malformed or never completes. A remote attacker can keep sending data and drive the process into memory exhaustion, causing denial of service.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["http-body","package","perl","psgi","web-apps"],"not_affected_if":["no-http-body-dependency","proxy-limits-body-size"],"how_to_check":"- Run `cpanm --info HTTP::Body` or `perl -MHTTP::Body -e 'print $HTTP::Body::VERSION'` to read the installed version.\n- Search dependency manifests and the lock file for `HTTP::Body` to see whether an application pulls it in.\n- Check whether the application passes chunked request bodies (requests without Content-Length) to HTTP::Body's add() method.","fix":"- Upgrade HTTP::Body to `1.24_01` or later.\n- Until upgraded, put a request body size limit in front of the application (reverse proxy or web server) so unbounded chunked input is rejected.","status":"open","published_at":"2026-10-28T18:17:14+00:00","first_seen_at":"2026-10-28T18:34:33+00:00","triaged_at":"2026-10-28T18:35:18+00:00","updated_at":"2026-10-28T18:35:18+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T18:35:18Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade HTTP::Body to `1.24_01` or later.\n- Until upgraded, put a request body size limit in front of the application (reverse proxy or web server) so unbounded chunked input is rejected.","reach":"internet","title":"Perl HTTP::Body: chunked request bodies exhaust server memory","impact":"medium","summary":"HTTP::Body, a Perl module for parsing HTTP request bodies, buffers chunked uploads without limit when a chunk line is malformed or never completes. A remote attacker can keep sending data and drive the process into memory exhaustion, causing denial of service.","category":"package","nicknames":[],"who_cares":["perl","http-body","web-apps","psgi"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote attacker exhausts server memory causing denial of service","analyst_note":"Check the NVD entry and the upstream HTTP::Body changelog for the exact fix and whether any workaround beyond upgrading is documented.","how_to_check":"- Run `cpanm --info HTTP::Body` or `perl -MHTTP::Body -e 'print $HTTP::Body::VERSION'` to read the installed version.\n- Search dependency manifests and the lock file for `HTTP::Body` to see whether an application pulls it in.\n- Check whether the application passes chunked request bodies (requests without Content-Length) to HTTP::Body's add() method.","needs_analyst":true,"not_affected_if":["no-http-body-dependency","proxy-limits-body-size"],"who_is_affected":"Perl applications that parse incoming HTTP request bodies with HTTP::Body, typically through a web framework or PSGI stack, are exposed when clients can send chunked requests without Content-Length. Applications that do not use HTTP::Body, or that sit behind a proxy which buffers and limits request bodies, are less exposed.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000681,"input_tokens":3394,"output_tokens":684,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117501':12A,15A '-2026':11A,14A '01':72C '1.24':71C 'add':95C,139C 'allow':75C 'app':24B 'applic':150C 'arriv':106C 'attack':51B,145C 'bodi':3A,6A,18B,26B,34B,68C,84C,155C,158C 'buffer':35B,80C,142C 'caus':63B 'chunk':4A,36B,42B,82C,86C,98C,114C,153C 'chunk-siz':113C 'complet':48B 'content':91C 'crlf':121C 'cve':10A,13A 'data':55B 'denial':64B 'drive':57B 'everi':137C 'exhaust':7A,62B,77C,147C 'fit':128C 'forev':135C 'given':94C 'grow':140C 'hold':96C 'http':2A,17B,25B,32B,67C,157C 'http-bodi':16B 'integ':130C 'keep':53B 'larg':126C 'later':138C 'leav':131C 'length':92C 'limit':39B 'line':43B,108C,116C,119C 'malform':45B 'memori':9A,61B,76C,100C,148C 'mode':87C 'modul':29B 'never':47B 'packag':19B 'pars':31B 'parser':133C 'pass':152C 'perl':1A,20B,28B,74C 'process':59B 'psgi':21B 'remot':50B,144C 'request':5A,33B,83C,154C 'send':54B 'server':8A 'servic':66B 'size':115C,118C,124C 'unbound':79C 'upload':37B 'use':88C 'version':69C 'via':78C 'wait':134C 'web':23B 'web-app':22B 'without':38B,120C","nicknames":[],"mitigations":[],"who_affected":"Perl applications that parse incoming HTTP request bodies with HTTP::Body, typically through a web framework or PSGI stack, are exposed when clients can send chunked requests without Content-Length. Applications that do not use HTTP::Body, or that sit behind a proxy which buffers and limits request bodies, are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T18:17:14+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117501","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117501","severity":null,"published_at":"2026-10-28T18:17:14+00:00","modified_at":"2026-10-28T18:17:14+00:00","first_seen_at":"2026-10-28T18:34:33+00:00","fetched_at":"2026-10-28T18:34:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}