HTTP::Body versions prior to 1.24_01 for Perl have a vulnerability where unbounded buffering of chunked HTTP request bodies can lead to memory exhaustion. This occurs because the parser holds each chunk in memory until the entire body is received, and malformed chunk size lines cause the parser to wait indefinitely, causing the buffer to grow without limit. Remote attackers can exploit this to exhaust memory in applications using HTTP::Body.
HTTP::Body versions before 1.24_01 for Perl contain an inefficient regular expression in the multipart upload filename parsing logic. This flaw allows a remote attacker to cause CPU exhaustion by sending a specially crafted filename with many dots ending in a backslash, triggering excessive regex backtracking. Each file part in a multipart request is processed separately, amplifying the impact. The issue is fixed in version 1.24_01.
HTTP::Body versions before 1.23_01 for Perl improperly handle chunked HTTP request bodies, losing track of chunk boundaries when a read ends inside a chunk. This can cause a server to hang indefinitely or prematurely consider a chunked body complete, potentially misinterpreting leftover bytes as a new request.
HTTP::Body versions before 1.23_01 for Perl contain a vulnerability where inefficient regular expression handling in chunked request body parsing can cause CPU exhaustion. This occurs due to quadratic regex backtracking when processing chunk-size lines without a preceding carriage return before a line feed. A remote attacker can exploit this by sending specially crafted chunked request bodies, leading to high CPU usage in affected applications.
HTTP::Body versions before 1.23_01 for Perl improperly handle mixed-case percent escapes in urlencoded form fields by dropping them instead of decoding. This causes inputs such as 'pass%aBword' to be interpreted differently by conforming decoders and the vulnerable library, potentially leading to inconsistent processing of form data.
CVE-2026-116134 is a vulnerability in HTTP::Body for Perl versions before 1.23_01 that allows a remote attacker to cause memory exhaustion. The issue arises because the multipart parser does not limit the size or number of lines in a multipart part header block, leading to excessive memory allocation.
HTTP::Body versions before 1.23_01 for Perl contain an inefficient algorithmic complexity vulnerability in the multipart body parser. The parser rescans the entire buffered body repeatedly when a multipart boundary is missing or malformed, leading to quadratic CPU time consumption. This allows a remote attacker to exhaust CPU resources by sending specially crafted HTTP requests with missing or malformed multipart boundaries.
HTTP::Body versions before 1.23_01 for Perl have an incomplete cleanup vulnerability where temporary files from incomplete multipart uploads remain on disk. This occurs because temporary files are only tracked and deleted if the upload part completes, leaving orphaned files when uploads end prematurely. An attacker can exploit this by sending repeated incomplete multipart requests, causing disk space exhaustion in the temporary directory.
CVE-2026-116131 is a vulnerability in HTTP::Body for Perl versions before 1.23_01 that allows an attacker to exhaust server memory or disk space by sending a request with an unlimited number of form fields or multipart parts. The urlencoded parser consumes excessive memory by creating a scalar per separator, and the multipart parser creates temporary files for each part with a filename, without limiting their number.