Zero Radar
← feed
HighVulnerabilityCVE-2026-116132updated 28 Oct 2026, 18:37 UTC

Perl HTTP::Body leaves temporary files behind after incomplete uploads

When someone starts uploading a file to a website but stops partway, this Perl library can leave a leftover file on the server that is never cleaned up. Repeated attempts can fill up the server's temporary storage.

Fixed in HTTP::Body 1.23_01 or laterOfficial, 2 sources
SeverityHighVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?YesHTTP::Body 1.23_01 or later · since 28 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1AttackerSends incomplete multipart uploads
  2. 2Parser starts fileTemp file created for each file part
  3. 3Upload cut offBody ends inside the file part
  4. 4Orphaned fileTemp file never added to cleanup list
  5. 5Disk fills upTemp directory runs out of space
  6. ResultTemporary storage is exhausted

What happened

HTTP::Body versions before 1.23_01 for Perl create a temporary file when a multipart file part starts but only register it for cleanup when the part completes. If the body ends inside a file part, the temporary file is orphaned on disk.

Why it is dangerous: A remote attacker can send many incomplete multipart requests, leaving one file per request and exhausting the temporary directory, which can disrupt the application or the server.

Are you affected?

You are affected if you run a Perl application that uses HTTP::Body versions before 1.23_01 to parse multipart form uploads.

HTTP::Body for Perl, versions before 1.23_01

What to do

  1. Update HTTP::Body to version 1.23_01 or later
  2. Check your temporary directory for leftover upload files and remove them
  3. Monitor disk usage on the temporary directory for unusual growth

Timeline

  1. 28 Oct 2026, 18:17 UTC
    Publicly disclosed
  2. 28 Oct 2026, 18:18 UTC
    Reported by oss-security · oss-security
  3. 28 Oct 2026, 18:30 UTC
    Picked up by Zero Radar
  4. 28 Oct 2026, 18:37 UTC
    NVD reported on it · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Security researchers research teams and mailing lists

Technical details

ID
CVE-2026-116132
Disclosed
28 Oct 2026, 18:17 UTC
On Zero Radar
28 Oct 2026, 18:30 UTC (13 min after disclosure)
Last change
28 Oct 2026, 18:37 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Perl HTTP::Body leaves temporary files behind after incomplete uploads · Zero Radar