HTTP::Body versions before 1.24_01 for Perl contain a vulnerability where a specially crafted multipart upload filename can cause CPU exhaustion due to regex backtracking. The multipart parser uses a regex to find the suffix of the uploaded filename, and filenames with many dots ending in a backslash cause quadratic-time regex backtracking. This allows a remote attacker to exhaust CPU resources with a single request, as matching a basename of about 32 KB can take several seconds.