Read the docs

Regex backtracking in HTTP::Body Perl module causes CPU exhaustion

Priority LOW 23CWE-1333Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Denial of service
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from CNA. Impact type from CWE-1333.

Summary

HTTP::Body for Perl versions before 1.24_01 is affected. Its multipart parser matches a regular expression against each uploaded filename, and a basename made of many dots ending in a backslash causes inefficient regex backtracking (CWE-1333). A remote attacker can exhaust CPU with a single request, since a basename of about 32 KB takes several seconds to match.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload. For every file part, the multipart parser finds the suffix of the uploaded filename by matching the default $basename_regexp, qr/[^.]+(\.[^\\\/]+)$/, against the whole basename. A basename made of many dots and ending in a backslash makes the regex backtrack in time quadratic in its length. A remote attacker can exhaust CPU with one request, as a basename of about 32 KB takes several seconds to match and every file part is matched separately.

Why it matters now

EPSS 0.00452 39th percentileScored 2026-11-07
Fix Fixed HTTP-Body: 1.24_01

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—HTTP-Bodybefore 1.24_011.24_01Patch availableCNA
  • HTTP-Body Vendor— Affected before 1.24_01 Fixed in 1.24_01 Patch available CNA

Remediation

The fixed version for HTTP-Body is 1.24_01.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA HTTP-Body Fixed in 1.24_01

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-117500
  2. 2026-10-28 Alias added: GHSA-w2gq-c2cx-w9q6
  3. 2026-10-30 Affected versions changed · Red Hat
  4. 2026-10-30 CVSS score added · Red Hat

References

Sources