Zero Radar
← feed
HighVulnerabilityCVE-2026-116133updated 28 Oct 2026, 18:37 UTC

Perl HTTP::Body can be made to use excessive CPU by malformed uploads

A specially crafted web upload with a broken or missing separator can make a Perl web application slow down and tie up its processor. Enough of these requests can make the service unresponsive.

Fixed in HTTP::Body 1.23_01 or laterOfficial, 2 sources
SeverityHighVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?YesHTTP::Body 1.23_01 or later · since 28 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends requestMultipart body with no valid boundary
  2. 2Parser buffers dataWaits for the next chunk
  3. 3Full rescan per chunkSearches whole body again each time
  4. 4CPU climbsWork grows quadratically with body size
  5. ResultWorker CPU exhausted, service slows or stalls

What happened

HTTP::Body for Perl rescans the whole buffered multipart body from the start each time a new chunk arrives when no valid boundary is found, causing quadratic CPU time (CWE-based CPU exhaustion).

Why it is dangerous: A remote attacker can exhaust worker CPU with only a few requests, causing denial of service for Perl applications that parse multipart form uploads.

Are you affected?

You are affected if you run a Perl application that uses HTTP::Body versions before 1.23_01 to parse multipart/form-data request bodies, for example through a web framework that depends on it.

HTTP::Body for Perl, all versions before 1.23_01

What to do

  1. Update HTTP::Body to version 1.23_01 or later
  2. Check whether your Perl web framework or app pulls in HTTP::Body and update it too
  3. Restart the affected application services after updating

Timeline

  1. 28 Oct 2026, 18:17 UTC
    Publicly disclosed
  2. 28 Oct 2026, 18:18 UTC
    Reported by oss-security · oss-security
  3. 28 Oct 2026, 18:30 UTC
    Picked up by Zero Radar
  4. 28 Oct 2026, 18:37 UTC
    NVD reported on it · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Security researchers research teams and mailing lists

Technical details

ID
CVE-2026-116133
Disclosed
28 Oct 2026, 18:17 UTC
On Zero Radar
28 Oct 2026, 18:30 UTC (13 min after disclosure)
Last change
28 Oct 2026, 18:37 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Perl HTTP::Body can be made to use excessive CPU by malformed uploads · Zero Radar