CVE-2026-116285
HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies
Unknown product
CVSS
NoneNot scoredExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 1.23_01CVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies.
In chunked mode, used when no content length is given, add() matches each chunk-size line with /^([\da-fA-F]+).*\x0D\x0A/. On a line of hex digits whose first LF has no CR before it, the digits and .* backtrack against each other, so a single add() takes time quadratic in the line's length. Nothing limits how long the line can be.
A remote attacker can exhaust CPU in applications that pass chunked request bodies to HTTP::Body.
Text from CVE List
Affected versions 1
- Productaffected: all versions before 1.23_01CVE List