CVE-2026-117501 HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-117501?
CVE-2026-117501 is a vulnerability, published on 28 Oct 2026.
Official description
HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies.
In chunked mode, used when no content length is given, add() holds each chunk in memory until all of it has arrived. A line that is not a chunk-size line, a size line without CRLF, or a size too large to fit an integer leaves the parser waiting forever, and every later add() grows the buffer.
A remote attacker can exhaust memory in applications that pass chunked request bodies to HTTP::Body.
Weakness: CWE-770
Which versions are affected by CVE-2026-117501?
How do I fix CVE-2026-117501?
No fix has been published for CVE-2026-117501 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-117501 being exploited?
There is no known exploitation of CVE-2026-117501 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-117501, GHSA-8xfg-4mgm-gg2r.