CVE-2026-116285

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. In chunked mode, used when no content length is given, add() matches each chunk-size line with `/^([\da-fA-F]+).*\x0D\x0A/`. On a line of hex digits whose first LF has no CR before it, the digits and `.*` backtrack against each other, so a single add() takes time quadratic in the line's length. Nothing limits how long the line can be. A remote attacker can exhaust CPU in applications that pass chunked request bodies to HTTP::Body.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-1333

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Full discourse1 post

Upwind Security MDR@UpwindMDR1d
🚨 CRITICAL - Multiple DoS & Request Smuggling/Parsing Flaws in Perl HTTP::Body A batch of vulnerabilities has been disclosed in Perl's widely used HTTP::Body module (underlying Catalyst, Plack, Dancer, and other web frameworks): • CVE-2026-116135: Drops mixed-case percent-encoded characters, causing parser discrepancies/desync with front-end proxies. • CVE-2026-116531: Chunk boundary tracking loss in chunked transfer decoding, enabling request smuggling/hanging. • CVE-2026-116285 & CVE-2026-117500: Catastrophic ReDoS backtracking in chunked line size parsing and multipart basename suffixes leading to CPU exhaustion. • CVE-2026-116134: Unthrottled buffer growth causing memory exhaustion DoS. 👉 Affected: HTTP::Body < 1.24 | Upgrade to v1.24 (or latest distro package fixes) immediately
0000084
389 followersView on X

Explore more

Back to dashboard