Memory exhaustion in HTTP::Body for Perl via multipart part headers
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-770.
Summary
HTTP::Body versions before 1.23_01 for Perl are affected. The multipart parser stores every line of the part header block, which has no size or line limit, in memory, using about 60 bytes per input byte (CWE-770). A remote unauthenticated attacker can exhaust worker memory with a single request.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
Description from the CNA
HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart part header block. The multipart parser takes everything up to the first blank line after a boundary as the part's header block, with no limit on its size or number of lines. Every line is stored in the part's header hash, so a block of short lines costs about 60 bytes of memory per input byte. A remote attacker can exhaust worker memory with a single request.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | HTTP-Body | before 1.23_01 | 1.23_01 | Patch available | CNA |
- HTTP-Body Vendor— Affected before 1.23_01 Fixed in 1.23_01 Patch available CNA
Remediation
HTTP-Body is fixed in version 1.23_01, so update HTTP::Body to version 1.23_01 or later.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
- Fix · CNA HTTP-Body Fixed in 1.23_01
Vendor assessments
Timeline
- 2026-10-28 Threatist record created from CVE-2026-116134
- 2026-10-28 Alias added: GHSA-hm6g-hrhc-g7hv
- 2026-10-29 Affected versions changed · Red Hat
- 2026-10-29 CVSS score added · Red Hat
- 2026-11-05 CVSS score added · CISA ADP
- 2026-11-05 CISA SSVC decision points changed
References
Sources
- CVE-2026-116134 · CVE Program
- CVE-2026-116134 · NVD
- FIRST EPSS
- GHSA-hm6g-hrhc-g7hv · GitHub Advisory Database · CC BY 4.0
- CVE-2026-116134 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences