Vulnerability Description
HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundary. Before the first part, and between parts, the multipart parser searches the whole buffered body for the next boundary. On a miss it keeps everything and searches again from the start when the next chunk arrives. A body with no boundary, or with a delimiter followed by neither CRLF nor "--", is therefore rescanned on every chunk, taking time quadratic in its size. A remote attacker can exhaust worker CPU with a few such requests.
Related Weaknesses (CWE)
References
- https://github.com/libwww-perl/HTTP-Body/commit/bf77eb959bbe1641b77f69eefe98d58c
- https://metacpan.org/release/GETTY/HTTP-Body-1.24/changes
FAQ
What is CVE-2026-116133?
CVE-2026-116133 is a documented vulnerability. HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundary. Before the first part, and between parts, the multi...
How severe is CVE-2026-116133?
CVSS scoring is not yet available for CVE-2026-116133. Check NVD for updates.
Is there a patch for CVE-2026-116133?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.