HTTP::Body for Perl mishandles chunk boundaries in chunked request bodies
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from CNA.
Summary
HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk, a weakness classified as CWE-130. In chunked mode, which is used when no content length is given, add() treats a chunk as complete once the buffer reaches the declared chunk size, but the buffer still holds the chunk-size line. When a read ends in the last bytes of a chunk, add() cuts the chunk short and parses the leftover data as the next chunk-size line. A remote attacker can make a chunked body never complete, hanging a server that reads until the body is done, or make it complete early so the remaining bytes are read as the next request.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk. In chunked mode, used when no content length is given, add() treats a chunk as complete once the buffer is as long as the chunk's declared size, but the buffer still holds the chunk-size line. When a read ends in the last bytes of a chunk, add() takes the chunk short and parses the leftover data as the next chunk-size line. A remote attacker can make a chunked body never complete, hanging a server that reads until the body is done, and may make it complete early, leaving the remaining bytes to be read as the next request.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | HTTP-Body | before 1.23_01 | 1.23_01 | Patch available | CNA |
- HTTP-Body Vendor— Affected before 1.23_01 Fixed in 1.23_01 Patch available CNA
Remediation
Upgrade HTTP::Body to version 1.23_01 or later.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA HTTP-Body Fixed in 1.23_01
Vendor assessments
Timeline
- 2026-10-28 Threatist record created from CVE-2026-116531
- 2026-10-28 Alias added: GHSA-288c-cm7p-6mc5
- 2026-10-29 Affected versions changed · Red Hat
- 2026-10-29 CVSS score added · Red Hat
References
Sources
- CVE-2026-116531 · CVE Program
- CVE-2026-116531 · NVD
- FIRST EPSS
- GHSA-288c-cm7p-6mc5 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-116531 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences