Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-116134— HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart part header block

Quick assessment

Affected
CVE-2026-116134
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Perl 的 HTTP::Body 模块 1.23_01 版本之前，存在一个内存耗尽漏洞：攻击者可通过构造无边界限制的多部分（multipart）数据块头部来触发该问题。 该模块的多部分解析器会将每个边界标记之后的内容（直到第一个空行为止）全部视为该部分的头部块，且未对其大小或行数设置任何限制。由于每一行都会被存入该部分的头部哈希表中，因此即使输入的是短行，每字节输入数据也会消耗约 60 字节的内存。 远程攻击者仅需发送单个请求，即可耗尽工作进程的内存资源。

AI Predicted 7.5 Difficulty: Trivial

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

I. Basic Information for CVE-2026-116134

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart part header block
Source: CVE Program / CVE List V5
Vulnerability Description
HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart part header block. The multipart parser takes everything up to the first blank line after a boundary as the part's header block, with no limit on its size or number of lines. Every line is stored in the part's header hash, so a block of short lines costs about 60 bytes of memory per input byte. A remote attacker can exhaust worker memory with a single request.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 1.23_01 -

II. Public POCs for CVE-2026-116134

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-116134

请登录查看更多情报信息。

Other References for CVE-2026-116134 (2)

IV. Related Vulnerabilities

Same weakness: CWE-770