CVE-2026-116531

LOWCVSS 9.1 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk. In chunked mode, used when no content length is given, add() treats a chunk as complete once the buffer is as long as the chunk's declared size, but the buffer still holds the chunk-size line. When a read ends in the last bytes of a chunk, add() takes the chunk short and parses the leftover data as the next chunk-size line. A remote attacker can make a chunked body never complete, hanging a server that reads until the body is done, and may make it complete early, leaving the remaining bytes to be read as the next request.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-130

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Full discourse1 post

Upwind Security MDR@UpwindMDR1d
🚨 CRITICAL - Multiple DoS & Request Smuggling/Parsing Flaws in Perl HTTP::Body A batch of vulnerabilities has been disclosed in Perl's widely used HTTP::Body module (underlying Catalyst, Plack, Dancer, and other web frameworks): • CVE-2026-116135: Drops mixed-case percent-encoded characters, causing parser discrepancies/desync with front-end proxies. • CVE-2026-116531: Chunk boundary tracking loss in chunked transfer decoding, enabling request smuggling/hanging. • CVE-2026-116285 & CVE-2026-117500: Catastrophic ReDoS backtracking in chunked line size parsing and multipart basename suffixes leading to CPU exhaustion. • CVE-2026-116134: Unthrottled buffer growth causing memory exhaustion DoS. 👉 Affected: HTTP::Body < 1.24 | Upgrade to v1.24 (or latest distro package fixes) immediately
0000084
389 followersView on X

Explore more

Back to dashboard