Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-116133— HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundary

Quick assessment

Affected
CVE-2026-116133
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 的 模块在 1.23_01 版本之前存在漏洞，攻击者可利用 multipart 请求体中缺失或格式错误的边界（boundary）触发二次扫描，从而导致 CPU 资源耗尽。 具体而言，在第一个部分之前以及各部分之间，multipart 解析器会扫描整个已缓冲的请求体以寻找下一个边界。若未找到边界，解析器将保留所有已接收数据，并在收到下一个数据块时从头开始重新扫描。因此，对于没有边界、或边界分隔符后未跟随 CRLF 或 的请求体，系统会在每个数据块到达时重新扫描整个内容，其处理时间随请求体大小呈二次方增长。

AI Predicted 7.5 Difficulty: Easy

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
None None < 1.23_01 affected

I. Basic Information for CVE-2026-116133

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundary
Source: CVE Program / CVE List V5
Vulnerability Description
HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundary. Before the first part, and between parts, the multipart parser searches the whole buffered body for the next boundary. On a miss it keeps everything and searches again from the start when the next chunk arrives. A body with no boundary, or with a delimiter followed by neither CRLF nor "--", is therefore rescanned on every chunk, taking time quadratic in its size. A remote attacker can exhaust worker CPU with a few such requests.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
算法复杂性
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 1.23_01 -

II. Public POCs for CVE-2026-116133

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-116133

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-116133 (1)

Vendor Pages for CVE-2026-116133 (1)

IV. Related Vulnerabilities

Same weakness: CWE-407