Vulnerability Description
HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. In chunked mode, used when no content length is given, add() holds each chunk in memory until all of it has arrived. A line that is not a chunk-size line, a size line without CRLF, or a size too large to fit an integer leaves the parser waiting forever, and every later add() grows the buffer. A remote attacker can exhaust memory in applications that pass chunked request bodies to HTTP::Body.
Related Weaknesses (CWE)
References
- https://github.com/libwww-perl/HTTP-Body/commit/7c6dc1ecd49e30ac405a3959c606ba38
- https://metacpan.org/release/GETTY/HTTP-Body-1.24_01/changes
FAQ
What is CVE-2026-117501?
CVE-2026-117501 is a documented vulnerability. HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. In chunked mode, used when no content length is given, add() holds each chunk in...
How severe is CVE-2026-117501?
CVSS scoring is not yet available for CVE-2026-117501. Check NVD for updates.
Is there a patch for CVE-2026-117501?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.