CVE-2026-116132

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-116132", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-10-25T11:14:04.979Z", "datePublished": "2026-10-28T17:15:00.711Z", "dateUpdated": "2026-11-05T20:04:11.006Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["HTTP::Body"], "packageName": "HTTP-Body", "packageURL": "pkg:cpan/HTTP-Body", "programFiles": ["lib/HTTP/Body.pm", "lib/HTTP/Body/MultiPart.pm"], "programRoutines": [{"name": "HTTP::Body::DESTROY"}, {"name": "HTTP::Body::MultiPart::handler"}], "repo": "https://github.com/libwww-perl/HTTP-Body", "versions": [{"lessThan": "1.23_01", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk.\n\nThe multipart parser creates a temporary file as soon as a file part starts, but adds it to the upload list only when the part completes. Uploads are only ever deleted from that list, by the cleanup option or by the caller, so a body that ends inside a file part leaves its temporary file where nothing can find it.\n\nA remote attacker can fill the temporary directory by repeating such requests, leaving one file behind for each."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-459", "description": "CWE-459 Incomplete Cleanup", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-10-28T17:15:00.711Z"}, "references": [{"tags": ["issue-tracking"], "url": "https://rt.cpan.org/Public/Bug/Display.html?id=84004"}, {"tags": ["patch"], "url": "https://github.com/libwww-perl/HTTP-Body/commit/29e933b22ff918ccf5412d3513c885208511cfa3.patch"}, {"tags": ["release-notes"], "url": "https://metacpan.org/release/GETTY/HTTP-Body-1.24/changes"}], "solutions": [{"lang": "en", "value": "Upgrade to HTTP-Body 1.23_01 or later."}], "source": {"discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2013-07-17T00:00:00.000Z", "value": "Issue reported."}, {"lang": "en", "time": "2026-10-26T00:00:00.000Z", "value": "Version 1.23_01 released with fix."}], "title": "HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T20:03:59.130703Z", "id": "CVE-2026-116132", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T20:04:11.006Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-116132", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-05T20:03:59.130703Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T20:03:35.431Z"}}], "cna": {"title": "HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/libwww-perl/HTTP-Body", "modules": ["HTTP::Body"], "versions": [{"status": "affected", "version": "0", "lessThan": "1.23_01", "versionType": "custom"}], "packageURL": "pkg:cpan/HTTP-Body", "packageName": "HTTP-Body", "programFiles": ["lib/HTTP/Body.pm", "lib/HTTP/Body/MultiPart.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "HTTP::Body::DESTROY"}, {"name": "HTTP::Body::MultiPart::handler"}]}], "timeline": [{"lang": "en", "time": "2013-07-17T00:00:00.000Z", "value": "Issue reported."}, {"lang": "en", "time": "2026-10-26T00:00:00.000Z", "value": "Version 1.23_01 released with fix."}], "solutions": [{"lang": "en", "value": "Upgrade to HTTP-Body 1.23_01 or later."}], "references": [{"url": "https://rt.cpan.org/Public/Bug/Display.html?id=84004", "tags": ["issue-tracking"]}, {"url": "https://github.com/libwww-perl/HTTP-Body/commit/29e933b22ff918ccf5412d3513c885208511cfa3.patch", "tags": ["patch"]}, {"url": "https://metacpan.org/release/GETTY/HTTP-Body-1.24/changes", "tags": ["release-notes"]}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk.\n\nThe multipart parser creates a temporary file as soon as a file part starts, but adds it to the upload list only when the part completes. Uploads are only ever deleted from that list, by the cleanup option or by the caller, so a body that ends inside a file part leaves its temporary file where nothing can find it.\n\nA remote attacker can fill the temporary directory by repeating such requests, leaving one file behind for each."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-459", "description": "CWE-459 Incomplete Cleanup"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-10-28T17:15:00.711Z"}}}, "cveMetadata": {"cveId": "CVE-2026-116132", "state": "PUBLISHED", "dateUpdated": "2026-11-05T20:04:11.006Z", "dateReserved": "2026-10-25T11:14:04.979Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-10-28T17:15:00.711Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["HTTP::Body"], "packageName": "HTTP-Body", "packageURL": "pkg:cpan/HTTP-Body", "programFiles": ["lib/HTTP/Body.pm", "lib/HTTP/Body/MultiPart.pm"], "programRoutines": [{"name": "HTTP::Body::DESTROY"}, {"name": "HTTP::Body::MultiPart::handler"}], "repo": "https://github.com/libwww-perl/HTTP-Body", "versions": [{"lessThan": "1.23_01", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk.\n\nThe multipart parser creates a temporary file as soon as a file part starts, but adds it to the upload list only when the part completes. Uploads are only ever deleted from that list, by the cleanup option or by the caller, so a body that ends inside a file part leaves its temporary file where nothing can find it.\n\nA remote attacker can fill the temporary directory by repeating such requests, leaving one file behind for each."}], "id": "CVE-2026-116132", "lastModified": "2026-11-05T20:17:43.477", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-116132", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T20:03:59.130703Z", "version": "2.0.3"}}]}, "published": "2026-10-28T18:17:12.347", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/libwww-perl/HTTP-Body/commit/29e933b22ff918ccf5412d3513c885208511cfa3.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/GETTY/HTTP-Body-1.24/changes"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://rt.cpan.org/Public/Bug/Display.html?id=84004"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-459"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{"bugzilla": {"description": "perl-http-body: HTTP::Body: Denial of Service via incomplete multipart uploads", "id": "2563028", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563028"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-459", "details": ["HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk.\nThe multipart parser creates a temporary file as soon as a file part starts, but adds it to the upload list only when the part completes. Uploads are only ever deleted from that list, by the cleanup option or by the caller, so a body that ends inside a file part leaves its temporary file where nothing can find it.\nA remote attacker can fill the temporary directory by repeating such requests, leaving one file behind for each.", "A flaw was found in HTTP::Body. A remote attacker could cause a Denial of Service (DoS) by sending repeated incomplete multipart upload requests. The multipart parser creates a temporary file when a file part begins but fails to track or clean it up if the upload terminates prematurely, allowing an attacker to exhaust available disk space."], "name": "CVE-2026-116132", "public_date": "2026-10-28T17:15:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-116132\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-116132\nhttps://github.com/libwww-perl/HTTP-Body/commit/29e933b22ff918ccf5412d3513c885208511cfa3.patch\nhttps://metacpan.org/release/GETTY/HTTP-Body-1.24/changes\nhttps://rt.cpan.org/Public/Bug/Display.html?id=84004"], "statement": "This vulnerability is rated as Important severity because unauthenticated remote attackers can exhaust filesystem storage without specialized privileges, leading to service disruption on the hosting system. Web applications utilizing this Perl module to process form submissions or file uploads are susceptible whenever multipart requests are disconnected prior to completion. In typical deployments where the temporary directory resides on the root filesystem, this storage depletion can impair co-located system services and applications.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.23_01)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "http-body", "vendor": "libwww-perl"}], "created": "2026-10-28T18:30:15.306095+00:00", "updated": "2026-11-05T22:15:14.897835+00:00", "vendors": ["libwww-perl", "libwww-perl$PRODUCT$http-body"]}