Skip to content
Heist/ feed
Back to feed
Unrated

HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk

Type: advisorySources: Official CVE List

HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk. In chunked mode, used when no content length is given, add() treats a chunk as complete once the buffer is as long as the chunk's declared size, but the buffer still holds the chunk-size line. When a read ends in the last bytes of a chunk, add() takes the chunk short and parses the leftover data as the next chunk-size line. A remote attacker can make a chunked body never complete, hanging a server that reads until the body is done, and may make it complete early, leaving the remaining bytes to be read as the next request.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-116531
Confirmed fixed CVEs
Not specified
Updated in this feed
1 Nov 2026, 20:23 UTC · Revision 1

Source evidence

HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk

core-cve · Original source

Published 28 Oct 2026, 17:16 UTC

HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk. In chunked mode, used when no content length is given, add() treats a chunk as complete once the buffer is as long as the chunk's declared size, but the buffer still holds the chunk-size line. When a read ends in the last bytes of a chunk, add() takes the chunk short and parses the leftover data as the next chunk-size line. A remote attacker can make a chunked body never complete, hanging a server that reads until the body is done, and may make it complete early, leaving the remaining bytes to be read as the next request.

cve:CVE-2026-116531
Complete source record
{
  "id": "33435ca123987bfe57a623e39910c62d96efbc5e287e12b0b6d3bf2afdf13c2a",
  "url": "https://www.cve.org/CVERecord?id=CVE-2026-116531",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk",
    "summary": "HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk. In chunked mode, used when no content length is given, add() treats a chunk as complete once the buffer is as long as the chunk's declared size, but the buffer still holds the chunk-size line. When a read ends in the last bytes of a chunk, add() takes the chunk short and parses the leftover data as the next chunk-size line. A remote attacker can make a chunked body never complete, hanging a server that reads until the body is done, and may make it complete early, leaving the remaining bytes to be read as the next request.",
    "evidence": "cve:CVE-2026-116531",
    "products": [],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2026-116531",
      "aliases": [
        "CVE-2026-116531"
      ],
      "metrics": [],
      "affected": [
        {
          "repo": "https://github.com/libwww-perl/HTTP-Body",
          "modules": [
            "HTTP::Body"
          ],
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.23_01",
              "versionType": "custom"
            }
          ],
          "packageURL": "pkg:cpan/HTTP-Body",
          "packageName": "HTTP-Body",
          "programFiles": [
            "lib/HTTP/Body.pm"
          ],
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "HTTP::Body::add"
            }
          ]
        }
      ],
      "modified": "2026-10-28T17:16:42.065Z",
      "provider": "cve",
      "references": [
        "https://github.com/libwww-perl/HTTP-Body/commit/5869dde9fe6d13f189a435b6583fd63fcc18677a.patch",
        "https://metacpan.org/release/GETTY/HTTP-Body-1.24/changes"
      ],
      "provider_metadata": {
        "cna": {
          "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
          "shortName": "CPANSec",
          "dateUpdated": "2026-10-28T17:16:42.065Z"
        }
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-116531",
        "evidence": "/cveMetadata/cveId"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-cve",
  "document_id": 466428,
  "published_at": "2026-10-28T17:16:42.065+00:00"
}