Everything after the last chunk in the same call to add() is parsed with HTTP::Headers, which takes time quadratic in the number of fields of one name. For example, it takes several seconds to parse 16 KiB of "a:" lines.
A remote attackercan exhause the CPU with a single request.
HTTP::Body version 1.25 limits the size and number of lines in the trailer.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
Upgrade to HTTP::Body version 1.24_02 or later.
Tracking
Sign in to view the affected projects.
No advisories yet.
Fri, 06 Nov 2026 08:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time. Everything after the last chunk in the same call to add() is parsed with HTTP::Headers, which takes time quadratic in the number of fields of one name. For example, it takes several seconds to parse 16 KiB of "a:" lines. A remote attackercan exhause the CPU with a single request. HTTP::Body version 1.25 limits the size and number of lines in the trailer. | |
| Title | HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time | |
| Weaknesses | CWE-770 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-11-06T07:47:23.570Z
Reserved: 2026-11-03T07:58:36.822Z
Link: CVE-2026-121006
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-06T08:17:19.827
Modified: 2026-11-06T08:17:19.827
Link: CVE-2026-121006
Redhat
No data.
OpenCVE Enrichment
No data.