Regex backtracking in HTTP::Body Perl module causes CPU exhaustion
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from CNA. Impact type from CWE-1333.
Summary
HTTP::Body for Perl versions before 1.24_01 is affected. Its multipart parser matches a regular expression against each uploaded filename, and a basename made of many dots ending in a backslash causes inefficient regex backtracking (CWE-1333). A remote attacker can exhaust CPU with a single request, since a basename of about 32 KB takes several seconds to match.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
Description from the CNA
HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload. For every file part, the multipart parser finds the suffix of the uploaded filename by matching the default $basename_regexp, qr/[^.]+(\.[^\\\/]+)$/, against the whole basename. A basename made of many dots and ending in a backslash makes the regex backtrack in time quadratic in its length. A remote attacker can exhaust CPU with one request, as a basename of about 32 KB takes several seconds to match and every file part is matched separately.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | HTTP-Body | before 1.24_01 | 1.24_01 | Patch available | CNA |
- HTTP-Body Vendor— Affected before 1.24_01 Fixed in 1.24_01 Patch available CNA
Remediation
The fixed version for HTTP-Body is 1.24_01.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
- Fix · CNA HTTP-Body Fixed in 1.24_01
Vendor assessments
Timeline
- 2026-10-28 Threatist record created from CVE-2026-117500
- 2026-10-28 Alias added: GHSA-w2gq-c2cx-w9q6
- 2026-10-30 Affected versions changed · Red Hat
- 2026-10-30 CVSS score added · Red Hat
References
Sources
- CVE-2026-117500 · CVE Program
- CVE-2026-117500 · NVD
- FIRST EPSS
- GHSA-w2gq-c2cx-w9q6 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-117500 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences