CVE-2026-121006 · Package
NO FIX YET · SEE WHAT TO DO
HTTP::Body for Perl parses the trailer of a chunked request with HTTP::Headers, which takes quadratic time in the number of header fields with one name. A single request with about 16 KiB of repeated header lines can take several seconds of CPU, letting a remote attacker exhaust the server's CPU.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that use HTTP::Body to parse request bodies, typically Perl web apps built on Catalyst, Plack or similar frameworks, are exposed when they accept chunked uploads from the internet. Apps that do not parse request bodies with HTTP::Body, or that sit behind a proxy that rejects chunked requests, are less exposed.
Not affected if no-chunked-requests, not-using-http-body
Who cares catalyst, http-body, perl, plack, web-app
perl -MHTTP::Body -e 'print $HTTP::Body::VERSION'1.25 or later (the sources state that 1.25 limits the size and number of trailer lines; 1.24_02 is the stated threshold)HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time.
Everything after the last chunk in the same call to add() is parsed with HTTP::Headers, which takes time quadratic in the number of fields of one name. For example, it takes several seconds to parse 16 KiB of "a:" lines.
A remote attackercan exhause the CPU with a single request.
HTTP::Body version 1.25 limits the size and number of lines in the trailer.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.