{"id":"CVE-2026-121006","kind":"vulnerability","aliases":["CVE-2026-121006"],"related":[],"title":"HTTP::Body for Perl: crafted request trailer exhausts CPU in quadratic parsing","description":"HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time.\n\nEverything after the last chunk in the same call to add() is parsed with HTTP::Headers, which takes time quadratic in the number of fields of one name.  For example, it takes several seconds to parse 16 KiB of \"a:\" lines.\n\nA remote attackercan exhause the CPU with a single request.\n\nHTTP::Body version 1.25 limits the size and number of lines in the trailer.","summary":"HTTP::Body for Perl parses the trailer of a chunked request with HTTP::Headers, which takes quadratic time in the number of header fields with one name. A single request with about 16 KiB of repeated header lines can take several seconds of CPU, letting a remote attacker exhaust the server's CPU.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["catalyst","http-body","package","perl","plack","web-app"],"not_affected_if":["no-chunked-requests","not-using-http-body"],"how_to_check":"- Check the installed version with `perl -MHTTP::Body -e 'print $HTTP::Body::VERSION'`\n- Search lock files and cpanfile or Makefile.PL for HTTP::Body versions below 1.24_02\n- Find the application that calls HTTP::Body add() on chunked request bodies, for example a Catalyst or Plack app","fix":"- HTTP::Body for Perl: upgrade to version `1.25` or later (the sources state that 1.25 limits the size and number of trailer lines; 1.24_02 is the stated threshold)","status":"open","published_at":"2026-11-06T08:17:19+00:00","first_seen_at":"2026-11-06T08:40:33+00:00","triaged_at":"2026-11-06T08:42:43+00:00","updated_at":"2026-11-06T08:42:43+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T08:42:43Z","model":"claude-haiku-5-5","output":{"fix":"- HTTP::Body for Perl: upgrade to version `1.25` or later (the sources state that 1.25 limits the size and number of trailer lines; 1.24_02 is the stated threshold)","reach":"internet","title":"HTTP::Body for Perl: crafted request trailer exhausts CPU in quadratic parsing","impact":"low","summary":"HTTP::Body for Perl parses the trailer of a chunked request with HTTP::Headers, which takes quadratic time in the number of header fields with one name. A single request with about 16 KiB of repeated header lines can take several seconds of CPU, letting a remote attacker exhaust the server's CPU.","audience":"developers","category":"package","nicknames":[],"who_cares":["perl","http-body","catalyst","plack","web-app"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"remote attacker exhausts server CPU with a single request","analyst_note":"","how_to_check":"- Check the installed version with `perl -MHTTP::Body -e 'print $HTTP::Body::VERSION'`\n- Search lock files and cpanfile or Makefile.PL for HTTP::Body versions below 1.24_02\n- Find the application that calls HTTP::Body add() on chunked request bodies, for example a Catalyst or Plack app","plain_action":"","needs_analyst":false,"not_affected_if":["no-chunked-requests","not-using-http-body"],"who_is_affected":"Applications that use HTTP::Body to parse request bodies, typically Perl web apps built on Catalyst, Plack or similar frameworks, are exposed when they accept chunked uploads from the internet. Apps that do not parse request bodies with HTTP::Body, or that sit behind a proxy that rejects chunked requests, are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00076,"input_tokens":4283,"output_tokens":664,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-121006':15A,18A '-2026':14A,17A '02':87C '1.24':86C '1.25':150C '16':61B,132C 'add':106C 'app':28B 'attack':76B 'attackercan':139C 'bodi':2A,22B,30B,83C,148C 'call':104C 'catalyst':19B 'chunk':38B,100C 'cpu':9A,72B,81B,142C 'craft':5A 'cve':13A,16A 'everyth':96C 'exampl':125C 'exhaus':140C 'exhaust':8A,77B 'field':52B,120C 'header':42B,51B,65B,111C 'http':1A,21B,29B,41B,82C,110C,147C 'http-bodi':20B 'kib':62B,133C 'last':99C 'let':73B 'limit':151C 'line':66B,136C,157C 'name':55B,123C 'number':49B,118C,155C 'one':54B,122C 'packag':23B 'pars':12A,33B,90C,108C,131C 'perl':4A,24B,32B,89C 'plack':25B 'quadrat':11A,45B,94C,115C 'remot':75B,138C 'repeat':64B 'request':6A,39B,58B,146C 'second':70B,129C 'server':79B 'sever':69B,128C 'singl':57B,145C 'size':153C 'take':44B,68B,113C,127C 'time':46B,95C,114C 'trailer':7A,35B,92C,160C 'version':84C,149C 'web':27B 'web-app':26B","nicknames":[],"mitigations":[],"who_affected":"Applications that use HTTP::Body to parse request bodies, typically Perl web apps built on Catalyst, Plack or similar frameworks, are exposed when they accept chunked uploads from the internet. Apps that do not parse request bodies with HTTP::Body, or that sit behind a proxy that rejects chunked requests, are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["catalyst","httpbody","medium","package","perl","plack","webapp"],"campaign_type":null,"search_a":"'-121006':15A,18A '-2026':14A,17A 'bodi':2A 'cpu':9A 'craft':5A 'cve':13A,16A 'exhaust':8A 'http':1A 'pars':12A 'perl':4A 'quadrat':11A 'request':6A 'trailer':7A","search_b":"'16':61B 'app':28B 'attack':76B 'bodi':22B,30B 'catalyst':19B 'chunk':38B 'cpu':72B,81B 'exhaust':77B 'field':52B 'header':42B,51B,65B 'http':21B,29B,41B 'http-bodi':20B 'kib':62B 'let':73B 'line':66B 'name':55B 'number':49B 'one':54B 'packag':23B 'pars':33B 'perl':24B,32B 'plack':25B 'quadrat':45B 'remot':75B 'repeat':64B 'request':39B,58B 'second':70B 'server':79B 'sever':69B 'singl':57B 'take':44B,68B 'time':46B 'trailer':35B 'web':27B 'web-app':26B","search_c":"'02':87C '1.24':86C '1.25':150C '16':132C 'add':106C 'attackercan':139C 'bodi':83C,148C 'call':104C 'chunk':100C 'cpu':142C 'everyth':96C 'exampl':125C 'exhaus':140C 'field':120C 'header':111C 'http':82C,110C,147C 'kib':133C 'last':99C 'limit':151C 'line':136C,157C 'name':123C 'number':118C,155C 'one':122C 'pars':90C,108C,131C 'perl':89C 'quadrat':94C,115C 'remot':138C 'request':146C 'second':129C 'sever':128C 'singl':145C 'size':153C 'take':113C,127C 'time':95C,114C 'trailer':92C,160C 'version':84C,149C","first_public_at":"2026-11-06T08:17:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121006","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121006","severity":null,"published_at":"2026-11-06T08:17:19+00:00","modified_at":"2026-11-06T08:17:19+00:00","first_seen_at":"2026-11-06T08:40:33+00:00","fetched_at":"2026-11-06T08:40:33+00:00","note":null}],"documents":[{"id":84758,"url":"https://github.com/libwww-perl/HTTP-Body/commit/983dd4ca3b863ab513240b02c91c3114fb299389.patch","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}