CVE-2026-117501
HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies
- State
- Published
- Severity
- Not scored
- Published
- Oct 28, 2026
- Updated
- Oct 28, 2026
- Reserved
- Oct 27, 2026
Description
HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies.
In chunked mode, used when no content length is given, add() holds each chunk in memory until all of it has arrived. A line that is not a chunk-size line, a size line without CRLF, or a size too large to fit an integer leaves the parser waiting forever, and every later add() grows the buffer.
A remote attacker can exhaust memory in applications that pass chunked request bodies to HTTP::Body.
Scores
The record has no CVSS score.
Weaknesses
- CWE-770 Allocation of Resources Without Limits or Throttling
Affected Products
| Product | Versions |
|---|---|
HTTP-Body |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.