Read the docs
TI-2026-85772 Aliases CVE-2026-121006GHSA-f4c2-m2fq-wp7w

HTTP::Body for Perl parses trailers in quadratic time, exhausting CPU

Priority LOW 22CWE-770Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Denial of service
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from CNA. Impact type from CWE-770.

Summary

HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time. Everything after the last chunk in one add() call is parsed with HTTP::Headers, which takes time that grows quadratically with the number of fields sharing one name (CWE-770, Allocation of Resources Without Limits or Throttling). A remote attacker can exhaust the CPU with a single request.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time. Everything after the last chunk in the same call to add() is parsed with HTTP::Headers, which takes time quadratic in the number of fields of one name. For example, it takes several seconds to parse 16 KiB of "a:" lines. A remote attackercan exhause the CPU with a single request. HTTP::Body version 1.25 limits the size and number of lines in the trailer.

Why it matters now

EPSS 0.00225 13th percentileScored 2026-11-07
Fix Fixed HTTP-Body: 1.24_02

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—HTTP-Bodybefore 1.24_021.24_02Patch availableCNA
  • HTTP-Body Vendor— Affected before 1.24_02 Fixed in 1.24_02 Patch available CNA

Remediation

Upgrade HTTP-Body to version 1.24_02 or later. Version 1.25 also limits the size and number of lines in the trailer.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA HTTP-Body Fixed in 1.24_02

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-121006
  2. 2026-11-06 Alias added: GHSA-f4c2-m2fq-wp7w

References

Patch 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences