CVE-2026-117500 HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload.

What is CVE-2026-117500?

CVE-2026-117500 is a vulnerability, published on 28 Oct 2026.

Official description

HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload.

For every file part, the multipart parser finds the suffix of the uploaded filename by matching the default $basename_regexp, qr/[^.]+(\.[^\\\/]+)$/, against the whole basename. A basename made of many dots and ending in a backslash makes the regex backtrack in time quadratic in its length.

A remote attacker can exhaust CPU with one request, as a basename of about 32 KB takes several seconds to match and every file part is matched separately.

Weakness: CWE-1333

Which versions are affected by CVE-2026-117500?

How do I fix CVE-2026-117500?

No fix has been published for CVE-2026-117500 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-117500 being exploited?

There is no known exploitation of CVE-2026-117500 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-117500, GHSA-w2gq-c2cx-w9q6.