CVE-2026-116133 HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundary.
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-116133?
CVE-2026-116133 is a vulnerability, published on 28 Oct 2026.
Official description
HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundary.
Before the first part, and between parts, the multipart parser searches the whole buffered body for the next boundary. On a miss it keeps everything and searches again from the start when the next chunk arrives. A body with no boundary, or with a delimiter followed by neither CRLF nor "--", is therefore rescanned on every chunk, taking time quadratic in its size.
A remote attacker can exhaust worker CPU with a few such requests.
Weakness: CWE-407
Which versions are affected by CVE-2026-116133?
How do I fix CVE-2026-116133?
No fix has been published for CVE-2026-116133 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-116133 being exploited?
There is no known exploitation of CVE-2026-116133 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-116133, GHSA-xcwx-vggw-cvw9.