CVE-2026-116134

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart part header block. The multipart parser takes everything up to the first blank line after a boundary as the part's header block, with no limit on its size or number of lines. Every line is stored in the part's header hash, so a block of short lines costs about 60 bytes of memory per input byte. A remote attacker can exhaust worker memory with a single request.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-770

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Full discourse1 post

Upwind Security MDR@UpwindMDR1d
🚨 CRITICAL - Multiple DoS & Request Smuggling/Parsing Flaws in Perl HTTP::Body A batch of vulnerabilities has been disclosed in Perl's widely used HTTP::Body module (underlying Catalyst, Plack, Dancer, and other web frameworks): • CVE-2026-116135: Drops mixed-case percent-encoded characters, causing parser discrepancies/desync with front-end proxies. • CVE-2026-116531: Chunk boundary tracking loss in chunked transfer decoding, enabling request smuggling/hanging. • CVE-2026-116285 & CVE-2026-117500: Catastrophic ReDoS backtracking in chunked line size parsing and multipart basename suffixes leading to CPU exhaustion. • CVE-2026-116134: Unthrottled buffer growth causing memory exhaustion DoS. 👉 Affected: HTTP::Body < 1.24 | Upgrade to v1.24 (or latest distro package fixes) immediately
0000084
389 followersView on X

Explore more

Back to dashboard