Changes for version 1.24_02 - 2026-11-03 (TRIAL RELEASE)
- SECURITY, CVE-2026-117500: the suffix of an upload's filename is worked out from its last 255 bytes only, only when $file_temp_suffix is unset, and for the default $basename_regexp by a string search instead of the regexp; a filename of many dots ending in a backslash made the default $basename_regexp take time quadratic in its length (7 s per part at the 32 KiB header limit, once per part) in the default configuration
- SECURITY, CVE-2026-117501: a chunked body is framed line by line with a limit on the chunk-size line ($HTTP::Body::max_chunk_line_size, 1024 bytes), chunk data is passed on as it arrives instead of being held until the chunk is complete, malformed framing (a line that is no chunk-size line, a size that does not fit an integer, chunk data not followed by CRLF) croaks instead of buffering forever, and nothing after the trailer or after the body parser is done is kept
- SECURITY, CVE-2026-121006: the trailer of a chunked body is limited to $HTTP::Body::max_trailer_size bytes (32768) and $HTTP::Body::max_trailer_lines header lines (100); everything that followed the last chunk in the same call to add() was parsed with HTTP::Headers, which takes time quadratic in the number of fields of one name (6 s for 16 KiB of "a:" lines)
- trailing_headers: a trailer is read up to its blank line also when it arrives in later calls to add() than the last chunk; it used to be lost
- XFormsMultipart: a part other than the start part now gets its temporary file and the NUL strip of RT#123615 like any upload; it used to be returned by upload without a tempname, its data dropped
- parse_header: a continuation line at the start of a part's header block is dropped instead of dying, and a line that is no header field is dropped instead of being stored under a made-up field name
- add: the caller's buffer is no longer modified in place when it exceeds the Content-Length, so a read-only value is accepted
- Docs: every method of the parser classes is described, add and length say what they return; the README lists every limit, $basename_regexp and all runtime prerequisites
- File::Spec is declared as a prerequisite
Documentation
Modules
HTTP Body Parser
HTTP Body Multipart Parser
HTTP Body OctetStream Parser
HTTP Body UrlEncoded Parser
HTTP Body XForms Parser
HTTP Body XForms multipart/related submission Parser