Unrated

HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies

Type: advisorySources: Official CVE List

HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. In chunked mode, used when no content length is given, add() holds each chunk in memory until all of it has arrived. A line that is not a chunk-size line, a size line without CRLF, or a size too large to fit an integer leaves the parser waiting forever, and every later add() grows the buffer. A remote attacker can exhaust memory in applications that pass chunked request bodies to HTTP::Body.

Products: Not specified
Affected versions: Not specified
Fixed versions: Not specified
CVEs: CVE-2026-117501
Confirmed fixed CVEs: Not specified
Updated in this feed: 1 Nov 2026, 20:23 UTC · Revision 1

Source evidence

HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies

core-cve · Original source

Published 28 Oct 2026, 17:17 UTC

cve:CVE-2026-117501

Complete source record

{
  "id": "919e00dd863970c9d9abac3dd824a6f4bd70786e6f11271d61c882f11f5ee809",
  "url": "https://www.cve.org/CVERecord?id=CVE-2026-117501",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies",
    "summary": "HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. In chunked mode, used when no content length is given, add() holds each chunk in memory until all of it has arrived. A line that is not a chunk-size line, a size line without CRLF, or a size too large to fit an integer leaves the parser waiting forever, and every later add() grows the buffer. A remote attacker can exhaust memory in applications that pass chunked request bodies to HTTP::Body.",
    "evidence": "cve:CVE-2026-117501",
    "products": [],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2026-117501",
      "aliases": [
        "CVE-2026-117501"
      ],
      "metrics": [],
      "affected": [
        {
          "repo": "https://github.com/libwww-perl/HTTP-Body",
          "modules": [
            "HTTP::Body"
          ],
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.24_01",
              "versionType": "custom"
            }
          ],
          "packageURL": "pkg:cpan/HTTP-Body",
          "packageName": "HTTP-Body",
          "programFiles": [
            "lib/HTTP/Body.pm"
          ],
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "HTTP::Body::add"
            }
          ]
        }
      ],
      "modified": "2026-10-28T17:17:28.215Z",
      "provider": "cve",
      "references": [
        "https://github.com/libwww-perl/HTTP-Body/commit/7c6dc1ecd49e30ac405a3959c606ba389718f556.patch",
        "https://metacpan.org/release/GETTY/HTTP-Body-1.24_01/changes"
      ],
      "provider_metadata": {
        "cna": {
          "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
          "shortName": "CPANSec",
          "dateUpdated": "2026-10-28T17:17:28.215Z"
        }
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-117501",
        "evidence": "/cveMetadata/cveId"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-cve",
  "document_id": 466426,
  "published_at": "2026-10-28T17:17:28.215+00:00"
}