CVE-2026-116134

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-116134", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-10-25T11:14:04.979Z", "datePublished": "2026-10-28T17:15:31.799Z", "dateUpdated": "2026-11-05T20:15:47.071Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["HTTP::Body"], "packageName": "HTTP-Body", "packageURL": "pkg:cpan/HTTP-Body", "programFiles": ["lib/HTTP/Body/MultiPart.pm"], "programRoutines": [{"name": "HTTP::Body::MultiPart::parse_header"}], "repo": "https://github.com/libwww-perl/HTTP-Body", "versions": [{"lessThan": "1.23_01", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart part header block.\n\nThe multipart parser takes everything up to the first blank line after a boundary as the part's header block, with no limit on its size or number of lines. Every line is stored in the part's header hash, so a block of short lines costs about 60 bytes of memory per input byte.\n\nA remote attacker can exhaust worker memory with a single request."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-10-28T17:15:31.799Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/libwww-perl/HTTP-Body/commit/c5d13911aabfad4a7ae4b6ee98ac2315400e5ed5.patch"}, {"tags": ["release-notes"], "url": "https://metacpan.org/release/GETTY/HTTP-Body-1.24/changes"}], "solutions": [{"lang": "en", "value": "Upgrade to HTTP-Body 1.23_01 or later."}], "source": {"discovery": "UNKNOWN"}, "title": "HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart part header block", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T20:14:31.013210Z", "id": "CVE-2026-116134", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T20:15:47.071Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-116134", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T20:14:31.013210Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T20:14:19.725Z"}}], "cna": {"title": "HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart part header block", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/libwww-perl/HTTP-Body", "modules": ["HTTP::Body"], "versions": [{"status": "affected", "version": "0", "lessThan": "1.23_01", "versionType": "custom"}], "packageURL": "pkg:cpan/HTTP-Body", "packageName": "HTTP-Body", "programFiles": ["lib/HTTP/Body/MultiPart.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "HTTP::Body::MultiPart::parse_header"}]}], "solutions": [{"lang": "en", "value": "Upgrade to HTTP-Body 1.23_01 or later."}], "references": [{"url": "https://github.com/libwww-perl/HTTP-Body/commit/c5d13911aabfad4a7ae4b6ee98ac2315400e5ed5.patch", "tags": ["patch"]}, {"url": "https://metacpan.org/release/GETTY/HTTP-Body-1.24/changes", "tags": ["release-notes"]}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart part header block.\n\nThe multipart parser takes everything up to the first blank line after a boundary as the part's header block, with no limit on its size or number of lines. Every line is stored in the part's header hash, so a block of short lines costs about 60 bytes of memory per input byte.\n\nA remote attacker can exhaust worker memory with a single request."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-10-28T17:15:31.799Z"}}}, "cveMetadata": {"cveId": "CVE-2026-116134", "state": "PUBLISHED", "dateUpdated": "2026-11-05T20:15:47.071Z", "dateReserved": "2026-10-25T11:14:04.979Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-10-28T17:15:31.799Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["HTTP::Body"], "packageName": "HTTP-Body", "packageURL": "pkg:cpan/HTTP-Body", "programFiles": ["lib/HTTP/Body/MultiPart.pm"], "programRoutines": [{"name": "HTTP::Body::MultiPart::parse_header"}], "repo": "https://github.com/libwww-perl/HTTP-Body", "versions": [{"lessThan": "1.23_01", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart part header block.\n\nThe multipart parser takes everything up to the first blank line after a boundary as the part's header block, with no limit on its size or number of lines. Every line is stored in the part's header hash, so a block of short lines costs about 60 bytes of memory per input byte.\n\nA remote attacker can exhaust worker memory with a single request."}], "id": "CVE-2026-116134", "lastModified": "2026-11-05T21:18:37.343", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-116134", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T20:14:31.013210Z", "version": "2.0.3"}}]}, "published": "2026-10-28T18:17:12.570", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/libwww-perl/HTTP-Body/commit/c5d13911aabfad4a7ae4b6ee98ac2315400e5ed5.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/GETTY/HTTP-Body-1.24/changes"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{"bugzilla": {"description": "perl-http-body: perl-http-body: Denial of Service via unbounded multipart header block", "id": "2563027", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563027"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart part header block.\nThe multipart parser takes everything up to the first blank line after a boundary as the part's header block, with no limit on its size or number of lines. Every line is stored in the part's header hash, so a block of short lines costs about 60 bytes of memory per input byte.\nA remote attacker can exhaust worker memory with a single request.", "A flaw was found in perl-http-body. The multipart request parser does not restrict the size or number of lines within a part's header block before storing them in memory. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request with an excessively large multipart header block, leading to memory exhaustion and causing a Denial of Service (DoS)."], "name": "CVE-2026-116134", "public_date": "2026-10-28T17:15:31Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-116134\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-116134\nhttps://github.com/libwww-perl/HTTP-Body/commit/c5d13911aabfad4a7ae4b6ee98ac2315400e5ed5.patch\nhttps://metacpan.org/release/GETTY/HTTP-Body-1.24/changes"], "statement": "Red Hat has rated this vulnerability as having an Important severity because an unauthenticated remote attacker can exhaust application memory and crash worker processes handling multipart HTTP data without requiring authentication or interaction. The affected package is not distributed within core Red Hat Enterprise Linux, but is packaged in EPEL and Fedora for Perl web service ecosystems. Deployments running web applications that rely on this library to parse untrusted file uploads or form submissions are exposed to service outages.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.23_01)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "product": "http-body", "vendor": "libwww-perl"}], "created": "2026-10-28T19:00:23.217243+00:00", "updated": "2026-10-31T01:30:11.557928+00:00", "vendors": ["libwww-perl", "libwww-perl$PRODUCT$http-body"]}