{"schema":"threatline.record/2","record":{"id":"CVE-2026-117500","aliases":[],"summary":"HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload","details":"HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload.\n\nFor every file part, the multipart parser finds the suffix of the uploaded filename by matching the default $basename_regexp, qr/[^.]+(\\.[^\\\\\\/]+)$/, against the whole basename. A basename made of many dots and ending in a backslash makes the regex backtrack in time quadratic in its length.\n\nA remote attacker can exhaust CPU with one request, as a basename of about 32 KB takes several seconds to match and every file part is matched separately.","categories":["Unclassified"],"product":"","vendor":"","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-117500","source_modified_at":"2026-10-28T17:17:11.051Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":null,"vendor":null,"versions":[{"lessThan":"1.24_01","status":"affected","version":"0","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-117500","source_modified_at":"2026-10-28T17:17:11.051Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":null,"ecosystem":null},"version":"1.24_01","basis":"first unaffected version stated in the CVE record"}],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T17:17:11.051Z","modified_at":"2026-10-28T17:17:11.051Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-117500","fetched_at":"2026-10-28T20:58:01.013507Z","source_modified_at":"2026-10-28T17:17:11.051Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/libwww-perl/HTTP-Body/commit/9ab46daaede02fb13ea55a7e3ede34c8b918d8ca.patch","tags":["patch"]},{"source":"CVE List","url":"https://github.com/libwww-perl/HTTP-Body/commit/3abc958d78bd84bf4abb87bad79b9432eab7e694.patch","tags":["patch"]},{"source":"CVE List","url":"https://metacpan.org/release/GETTY/HTTP-Body-1.24_01/changes","tags":["release-notes"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-28T17:17:11.051Z","content_hash":"41676dba6cb8a1b412b873a93e45a074800cd724a5001fa757619e8d8986600e"}}