---
id: "CVE-2026-117501"
kind: "vulnerability"
aliases: ["CVE-2026-117501"]
title: "Perl HTTP::Body: chunked request bodies exhaust server memory"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["http-body", "package", "perl", "psgi", "web-apps"]
not_affected_if: ["no-http-body-dependency", "proxy-limits-body-size"]
published_at: "2026-10-28T18:17:14+00:00"
first_seen_at: "2026-10-28T18:34:33+00:00"
updated_at: "2026-10-28T18:35:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117501", "first_seen_at": "2026-10-28T18:34:33+00:00"}]
---

# Perl HTTP::Body: chunked request bodies exhaust server memory

HTTP::Body, a Perl module for parsing HTTP request bodies, buffers chunked uploads without limit when a chunk line is malformed or never completes. A remote attacker can keep sending data and drive the process into memory exhaustion, causing denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `cpanm --info HTTP::Body` or `perl -MHTTP::Body -e 'print $HTTP::Body::VERSION'` to read the installed version.
- Search dependency manifests and the lock file for `HTTP::Body` to see whether an application pulls it in.
- Check whether the application passes chunked request bodies (requests without Content-Length) to HTTP::Body's add() method.

## Fix

- Upgrade HTTP::Body to `1.24_01` or later.
- Until upgraded, put a request body size limit in front of the application (reverse proxy or web server) so unbounded chunked input is rejected.

## Timeline

- 2026-10-28T18:34:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117501

## From the sources

HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies.

In chunked mode, used when no content length is given, add() holds each chunk in memory until all of it has arrived. A line that is not a chunk-size line, a size line without CRLF, or a size too large to fit an integer leaves the parser waiting forever, and every later add() grows the buffer.

A remote attacker can exhaust memory in applications that pass chunked request bodies to HTTP::Body.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_