CVE-2026-117501

Full vulnerability record from the local CVENow database.

Description

HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. In chunked mode, used when no content length is given, add() holds each chunk in memory until all of it has arrived. A line that is not a chunk-size line, a size line without CRLF, or a size too large to fit an integer leaves the parser waiting forever, and every later add() grows the buffer. A remote attacker can exhaust memory in applications that pass chunked request bodies to HTTP::Body.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Awaiting Analysis

Source identifier

9b29abf9-4ab0-4765-b253-1875cd9b441e

Published

2026-10-28 18:17:14.857000

Last modified

2026-10-29 15:11:53

View original CVE JSON

{
  "id": "CVE-2026-117501",
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
  "published": "2026-10-28T18:17:14.857",
  "lastModified": "2026-10-29T15:11:53.000",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies.\n\nIn chunked mode, used when no content length is given, add() holds each chunk in memory until all of it has arrived. A line that is not a chunk-size line, a size line without CRLF, or a size too large to fit an integer leaves the parser waiting forever, and every later add() grows the buffer.\n\nA remote attacker can exhaust memory in applications that pass chunked request bodies to HTTP::Body."
    }
  ],
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "collectionURL": "https://cpan.org/modules",
          "packageName": "HTTP-Body",
          "modules": [
            "HTTP::Body"
          ],
          "programFiles": [
            "lib/HTTP/Body.pm"
          ],
          "programRoutines": [
            {
              "name": "HTTP::Body::add"
            }
          ],
          "repo": "https://github.com/libwww-perl/HTTP-Body",
          "packageURL": "pkg:cpan/HTTP-Body",
          "versions": [
            {
              "version": "0",
              "lessThan": "1.24_01",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "weaknesses": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/libwww-perl/HTTP-Body/commit/7c6dc1ecd49e30ac405a3959c606ba389718f556.patch",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://metacpan.org/release/GETTY/HTTP-Body-1.24_01/changes",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    }
  ]
}