/ 
HTTP-Body-1.23_01
Security Advisories (2)
CVE-2026-117500 (2026-10-28)

HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload. For every file part, the multipart parser finds the suffix of the uploaded filename by matching the default $basename_regexp, qr/[^.]+(\.[^\\\/]+)$/, against the whole basename. A basename made of many dots and ending in a backslash makes the regex backtrack in time quadratic in its length. A remote attacker can exhaust CPU with one request, as a basename of about 32 KB takes several seconds to match and every file part is matched separately.

CVE-2026-117501 (2026-10-28)

HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. In chunked mode, used when no content length is given, add() holds each chunk in memory until all of it has arrived. A line that is not a chunk-size line, a size line without CRLF, or a size too large to fit an integer leaves the parser waiting forever, and every later add() grows the buffer. A remote attacker can exhaust memory in applications that pass chunked request bodies to HTTP::Body.

Changes for version 1.23_01 - 2026-10-26 (TRIAL RELEASE)

  • SECURITY: fixes for five issues reported by the CPAN Security Group (CPANSec), with patches by CPANSec:
    • CVE-2026-116132: the temporary file of an upload that is still incomplete at DESTROY-time is now always deleted
    • CVE-2026-116134: a multipart part's header block is limited to $HTTP::Body::MultiPart::max_header_size bytes (32768) and $HTTP::Body::MultiPart::max_header_lines lines (100)
    • CVE-2026-116135: mixed-case percent escapes (e.g. %aB) in urlencoded bodies are decoded instead of being dropped
    • CVE-2026-116133: a multipart body without a boundary or with a malformed delimiter line no longer takes quadratic time; a malformed delimiter line now croaks, and padding or an epilogue after the close delimiter is accepted
    • CVE-2026-116131: urlencoded bodies are limited to $HTTP::Body::UrlEncoded::max_params fields and multipart bodies to $HTTP::Body::MultiPart::max_parts parts (1000 each)
  • SECURITY: CVE-2026-116285: the chunk size line of a chunked body is matched in linear instead of quadratic time
  • SECURITY: a chunked body is now framed independently of where the reads feeding add() fall; a read that split a chunk could leave the parser never reaching 'done', hanging a server that reads until done
  • RT#105021: temp-file write errors in MultiPart and OctetStream are reported (croak) instead of silently truncating the stored body
  • RT#123615: a NUL byte in a multipart filename is stripped
  • RT#84004: the temp file of an aborted upload is cleaned up (see CVE-2026-116132 above)
  • INCOMPATIBLE: add() now croaks when one of the new limits is exceeded. Raise the variable, or set it to 0 to disable that limit, if your forms need more. See NOTES in HTTP::Body.
  • Moved repository from Shadowcat git to GitHub (libwww-perl/HTTP-Body)
  • Updated all metadata resources to point to GitHub
  • Fixed prerequisites: moved Digest::MD5 to test deps, changed HTTP::Headers to HTTP::Message
  • Added README.md for GitHub
  • Updated support section in documentation

Documentation

README.md

Modules

HTTP::Body
HTTP Body Parser
HTTP::Body::MultiPart
HTTP Body Multipart Parser
HTTP::Body::OctetStream
HTTP Body OctetStream Parser
HTTP::Body::UrlEncoded
HTTP Body UrlEncoded Parser
HTTP::Body::XForms
HTTP Body XForms Parser
HTTP::Body::XFormsMultipart
HTTP Body XForms multipart/related submission Parser

Other files