CVE-2026-116531 HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk.
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-116531?
CVE-2026-116531 is a vulnerability, published on 28 Oct 2026.
Official description
HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk.
In chunked mode, used when no content length is given, add() treats a chunk as complete once the buffer is as long as the chunk's declared size, but the buffer still holds the chunk-size line. When a read ends in the last bytes of a chunk, add() takes the chunk short and parses the leftover data as the next chunk-size line.
A remote attacker can make a chunked body never complete, hanging a server that reads until the body is done, and may make it complete early, leaving the remaining bytes to be read as the next request.
Weakness: CWE-130
Which versions are affected by CVE-2026-116531?
How do I fix CVE-2026-116531?
No fix has been published for CVE-2026-116531 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-116531 being exploited?
There is no known exploitation of CVE-2026-116531 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-116531, GHSA-288c-cm7p-6mc5.