CVE-2026-116131— HTTP::Body versions before 1.23_01 for Perl allow memory and temporary file exhaustion via an unlimited number of form fields and multipart parts

Quick assessment

Affected

CVE-2026-116131

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 的 HTTP::Body 模块在 1.23_01 版本之前存在漏洞，攻击者可通过构造包含无限数量表单字段和 multipart 部分的请求，导致内存耗尽和临时文件耗尽。具体而言，urlencoded 解析器会一次性按分隔符将整个请求体拆分，在存储任何字段之前，为每个分隔符创建一个标量变量。这导致每字节分隔符约消耗 90 字节的内存。而 multipart 解析器会为每个携带文件名的部分创建一个临时文件。上述两种解析器均未对请求体中可包含的字段数量或部分数量进行限制。远程攻击者可利用该漏洞，通过构造仅由

AI Predicted 7.5 Difficulty: Trivial Updated Oct 29, 2026

Possible ATT&CK Techniques 2 AI

T1499.001 · OS Exhaustion Flood T1499.003 · Application Exhaustion Flood

Affected Version Matrix 1

Vendor	Product	Version Range	Status
None	None	`< 1.23_01`	affected

Updated Oct 29, 2026

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

HTTP::Body versions before 1.23_01 for Perl allow memory and temporary file exhaustion via an unlimited number of form fields and multipart parts

Source: CVE Program / CVE List V5

Vulnerability Description

HTTP::Body versions before 1.23_01 for Perl allow memory and temporary file exhaustion via an unlimited number of form fields and multipart parts. The urlencoded parser splits the whole body on its separators at once, creating one scalar per separator before any field is stored. This costs about 90 bytes of memory per separator byte. The multipart parser creates a temporary file for every part that carries a filename. Neither parser limits how many fields or parts a body may hold. A remote attacker can exhaust worker memory with a body made of separators, or create thousands of temporary files with one request of small file parts.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

不加限制或调节的资源分配

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
-	-	0 ~ 1.23_01	-

II. Public POCs for CVE-2026-116131

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116131

请登录查看更多情报信息。

Other References for CVE-2026-116131 (2)

https://github.com/libwww-perl/HTTP-Body/commit/47beca524a3062eacfd646664576f005fb4be19b.patch patch
Changes - metacpan.org release-notes

https://www.cve.org/CVERecord?id=CVE-2026-116131

IV. Related Vulnerabilities

Same weakness: CWE-770