{"schema":"threatline.record/2","record":{"id":"CVE-2026-116133","aliases":[],"summary":"HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundary","details":"HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundary.\n\nBefore the first part, and between parts, the multipart parser searches the whole buffered body for the next boundary. On a miss it keeps everything and searches again from the start when the next chunk arrives. A body with no boundary, or with a delimiter followed by neither CRLF nor \"--\", is therefore rescanned on every chunk, taking time quadratic in its size.\n\nA remote attacker can exhaust worker CPU with a few such requests.","categories":["Unclassified"],"product":"","vendor":"","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116133","source_modified_at":"2026-10-28T17:15:16.522Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":null,"vendor":null,"versions":[{"lessThan":"1.23_01","status":"affected","version":"0","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116133","source_modified_at":"2026-10-28T17:15:16.522Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":null,"ecosystem":null},"version":"1.23_01","basis":"first unaffected version stated in the CVE record"}],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T17:15:16.522Z","modified_at":"2026-10-28T17:15:16.522Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-116133","fetched_at":"2026-10-28T20:58:01.013507Z","source_modified_at":"2026-10-28T17:15:16.522Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/libwww-perl/HTTP-Body/commit/bf77eb959bbe1641b77f69eefe98d58ce4c4ec79.patch","tags":["patch"]},{"source":"CVE List","url":"https://metacpan.org/release/GETTY/HTTP-Body-1.24/changes","tags":["release-notes"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-28T17:15:16.522Z","content_hash":"fdf2ff9fced2a69be9330d551605f8de8f194b90875c11be4cbae0c189ec2049"}}