CVE-2026-117500

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload. For every file part, the multipart parser finds the suffix of the uploaded filename by matching the default $basename_regexp, qr/[^.]+(\.[^\\\/]+)$/, against the whole basename. A basename made of many dots and ending in a backslash makes the regex backtrack in time quadratic in its length. A remote attacker can exhaust CPU with one request, as a basename of about 32 KB takes several seconds to match and every file part is matched separately.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-1333

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Full discourse1 post

Upwind Security MDR@UpwindMDR1d
🚨 CRITICAL - Multiple DoS & Request Smuggling/Parsing Flaws in Perl HTTP::Body A batch of vulnerabilities has been disclosed in Perl's widely used HTTP::Body module (underlying Catalyst, Plack, Dancer, and other web frameworks): • CVE-2026-116135: Drops mixed-case percent-encoded characters, causing parser discrepancies/desync with front-end proxies. • CVE-2026-116531: Chunk boundary tracking loss in chunked transfer decoding, enabling request smuggling/hanging. • CVE-2026-116285 & CVE-2026-117500: Catastrophic ReDoS backtracking in chunked line size parsing and multipart basename suffixes leading to CPU exhaustion. • CVE-2026-116134: Unthrottled buffer growth causing memory exhaustion DoS. 👉 Affected: HTTP::Body < 1.24 | Upgrade to v1.24 (or latest distro package fixes) immediately
0000084
389 followersView on X

Explore more

Back to dashboard