---
id: "CVE-2026-121006"
page: "https://infrastack.ai/live/CVE-2026-121006"
kind: "vulnerability"
aliases: ["CVE-2026-121006"]
title: "HTTP::Body for Perl: crafted request trailer exhausts CPU in quadratic parsing"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["catalyst", "http-body", "package", "perl", "plack", "web-app"]
not_affected_if: ["no-chunked-requests", "not-using-http-body"]
published_at: "2026-11-06T08:17:19+00:00"
first_seen_at: "2026-11-06T08:40:33+00:00"
updated_at: "2026-11-06T08:42:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121006", "first_seen_at": "2026-11-06T08:40:33+00:00"}]
exploit_sources: []
---

# HTTP::Body for Perl: crafted request trailer exhausts CPU in quadratic parsing

Link for people: https://infrastack.ai/live/CVE-2026-121006 (this .md is for agents)

HTTP::Body for Perl parses the trailer of a chunked request with HTTP::Headers, which takes quadratic time in the number of header fields with one name. A single request with about 16 KiB of repeated header lines can take several seconds of CPU, letting a remote attacker exhaust the server's CPU.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `perl -MHTTP::Body -e 'print $HTTP::Body::VERSION'`
- Search lock files and cpanfile or Makefile.PL for HTTP::Body versions below 1.24_02
- Find the application that calls HTTP::Body add() on chunked request bodies, for example a Catalyst or Plack app

## Fix

- HTTP::Body for Perl: upgrade to version `1.25` or later (the sources state that 1.25 limits the size and number of trailer lines; 1.24_02 is the stated threshold)

## Timeline

- 2026-11-06T08:40:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121006

## Documents

- [fix] Patch: github.com https://github.com/libwww-perl/HTTP-Body/commit/983dd4ca3b863ab513240b02c91c3114fb299389.patch

## From the sources

HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time.

Everything after the last chunk in the same call to add() is parsed with HTTP::Headers, which takes time quadratic in the number of fields of one name.  For example, it takes several seconds to parse 16 KiB of "a:" lines.

A remote attackercan exhause the CPU with a single request.

HTTP::Body version 1.25 limits the size and number of lines in the trailer.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_