cpan HTTP-Body vulnerabilities

Latest cpan HTTP-Body CVEs

Newest publication first

1. CVE-2026-121006 HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time

   Published 2026-11-06

   High·CVSS 7.5 EPSS 0.42%

   HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time. Everything after the last chunk in the same call to add() is parsed with HTTP::Headers, which takes time quadratic in the number of fields of one name. For example, it takes several seconds to parse...

2. CVE-2026-117501 HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies

   Published 2026-10-28

   High·CVSS 7.5 EPSS 0.39%

   HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. In chunked mode, used when no content length is given, add() holds each chunk in memory until all of it has arrived. A line that is not a chunk-size line, a size...

3. CVE-2026-117500 HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload

   Published 2026-10-28

   High·CVSS 7.5 EPSS 0.45%

   HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload. For every file part, the multipart parser finds the suffix of the uploaded filename by matching the default $basename_regexp, qr/[^.]+(.[^\/]+)$/, agains...

4. CVE-2026-116531 HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk

   Published 2026-10-28

   Critical·CVSS 9.1 EPSS 0.40%

   HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk. In chunked mode, used when no content length is given, add() treats a chunk as complete once the buffer is as long as the chunk's declared size, b...

5. CVE-2026-116285 HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies

   Published 2026-10-28

   High·CVSS 7.5 EPSS 0.39%

   HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. In chunked mode, used when no content length is given, add() matches each chunk-size line with /^([\da-fA-F]+).*\x0D\x0A/. On a line of hex digit...

6. CVE-2026-116135 HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them

   Published 2026-10-28

   Critical·CVSS 9.8 EPSS 0.60%

   HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them. The decode table holds only the all-lowercase and all-uppercase spelling of each hex pair, while the escape pattern matches either case. An escape suc...

7. CVE-2026-116134 HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart part header block

   Published 2026-10-28

   High·CVSS 7.5 EPSS 0.47%

   HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart part header block. The multipart parser takes everything up to the first blank line after a boundary as the part's header block, with no limit on its size or number of lines. Every line...

8. CVE-2026-116133 HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundary

   Published 2026-10-28

   High·CVSS 7.5 EPSS 0.47%

   HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundary. Before the first part, and between parts, the multipart parser searches the whole buffered body for the next boundary. On a miss it...

9. CVE-2026-116132 HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk

   Published 2026-10-28

   High·CVSS 7.1 EPSS 0.23%

   HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk. The multipart parser creates a temporary file as soon as a file part starts, but adds it to the upload list only when the part completes. Uploads are only ever deleted...

10. CVE-2026-116131 HTTP::Body versions before 1.23_01 for Perl allow memory and temporary file exhaustion via an unlimited number of form fields and multipart parts

    Published 2026-10-28

    Medium·CVSS 6.5 EPSS 0.42%

    HTTP::Body versions before 1.23_01 for Perl allow memory and temporary file exhaustion via an unlimited number of form fields and multipart parts. The urlencoded parser splits the whole body on its separators at once, creating one scalar per separator before any field is stored....

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.