Vulnerability Description
HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. In chunked mode, used when no content length is given, add() matches each chunk-size line with `/^([\da-fA-F]+).*\x0D\x0A/`. On a line of hex digits whose first LF has no CR before it, the digits and `.*` backtrack against each other, so a single add() takes time quadratic in the line's length. Nothing limits how long the line can be. A remote attacker can exhaust CPU in applications that pass chunked request bodies to HTTP::Body.
Related Weaknesses (CWE)
References
- https://github.com/libwww-perl/HTTP-Body/commit/954a5343d2a095b59d357f28759c5388
- https://metacpan.org/release/GETTY/HTTP-Body-1.24/changes
FAQ
What is CVE-2026-116285?
CVE-2026-116285 is a documented vulnerability. HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. In chunked mode, used when no content length is given, add() mat...
How severe is CVE-2026-116285?
CVSS scoring is not yet available for CVE-2026-116285. Check NVD for updates.
Is there a patch for CVE-2026-116285?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.