CVE-2026-116134

{"id": "CVE-2026-116134", "cveTags": [], "metrics": {}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://github.com/libwww-perl/HTTP-Body", "modules": ["HTTP::Body"], "versions": [{"status": "affected", "version": "0", "lessThan": "1.23_01", "versionType": "custom"}], "packageURL": "pkg:cpan/HTTP-Body", "packageName": "HTTP-Body", "programFiles": ["lib/HTTP/Body/MultiPart.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "HTTP::Body::MultiPart::parse_header"}]}]}], "published": "2026-10-28T18:17:12.570", "references": [{"url": "https://github.com/libwww-perl/HTTP-Body/commit/c5d13911aabfad4a7ae4b6ee98ac2315400e5ed5.patch", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/GETTY/HTTP-Body-1.24/changes", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart part header block.\n\nThe multipart parser takes everything up to the first blank line after a boundary as the part's header block, with no limit on its size or number of lines. Every line is stored in the part's header hash, so a block of short lines costs about 60 bytes of memory per input byte.\n\nA remote attacker can exhaust worker memory with a single request."}], "lastModified": "2026-10-29T15:11:53.000", "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}