CPANSA-HTTP-Body-2026-117501: HTTP-Body vulnerability

Publisher giterlizzi Document category csaf_security_advisory
Initial release date 2026-10-28T00:00:00 Engine CSAF Perl Toolkit 0.26
Current release date 2026-10-28T00:00:00 Build Date
Current version 1 Status final
CVSS v3.1 Base Score Severity
Original language Language en
Also referred to

Vulnerability Description

HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies.

In chunked mode, used when no content length is given, add() holds each chunk in memory until all of it has arrived. A line that is not a chunk-size line, a size line without CRLF, or a size too large to fit an integer leaves the parser waiting forever, and every later add() grows the buffer.

A remote attacker can exhaust memory in applications that pass chunked request bodies to HTTP::Body.

Vulnerabilities

CVE-2026-117501

Vulnerability Description

HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies.

In chunked mode, used when no content length is given, add() holds each chunk in memory until all of it has arrived. A line that is not a chunk-size line, a size line without CRLF, or a size too large to fit an integer leaves the parser waiting forever, and every later add() grows the buffer.

A remote attacker can exhaust memory in applications that pass chunked request bodies to HTTP::Body.

Weakness CWE-770 : Allocation of Resources Without Limits or Throttling

Product status

Known affected
Product Score
HTTP-Body less than 1.24_01
CVSS Version CVSS Vector CVSS Base Score CVSS Base Severity
Fixed

giterlizzi

Namespace: https://github.com/giterlizzi/

gdt@cpan.org

References

Revision history

Version Date of the revision Summary of the revision
1 Wed Oct 28 00:00:00 2026 First release

Sharing rules

TLP:WHITE
For the TLP version see: https://www.first.org/tlp/