The multipart parser takes everything up to the first blank line after a boundary as the part's header block, with no limit on its size or number of lines. Every line is stored in the part's header hash, so a block of short lines costs about 60 bytes of memory per input byte.
A remote attacker can exhaust worker memory with a single request.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
Upgrade to HTTP-Body 1.23_01 or later.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 28 Oct 2026 17:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart part header block. The multipart parser takes everything up to the first blank line after a boundary as the part's header block, with no limit on its size or number of lines. Every line is stored in the part's header hash, so a block of short lines costs about 60 bytes of memory per input byte. A remote attacker can exhaust worker memory with a single request. | |
| Title | HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart part header block | |
| Weaknesses | CWE-770 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-10-28T17:15:31.799Z
Reserved: 2026-10-25T11:14:04.979Z
Link: CVE-2026-116134
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-28T18:17:12.570
Modified: 2026-10-28T18:17:12.570
Link: CVE-2026-116134
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-28T19:00:23Z