CVE-2026-116134
HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart part header block
Unknown product
CVSS
NoneNot scoredExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 1.23_01CVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart part header block.
The multipart parser takes everything up to the first blank line after a boundary as the part's header block, with no limit on its size or number of lines. Every line is stored in the part's header hash, so a block of short lines costs about 60 bytes of memory per input byte.
A remote attacker can exhaust worker memory with a single request.
Text from CVE List
Affected versions 1
- Productaffected: all versions before 1.23_01CVE List