CVE-2026-116285— HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies

Quick assessment

Affected

CVE-2026-116285

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Perl 的 HTTP::Body 模块中，1.23_01 之前的版本存在一个安全漏洞：当解析分块（chunked）请求主体时，攻击者可通过触发二次方复杂度的正则回溯（quadratic regex backtracking）导致 CPU 资源耗尽。具体而言，在未提供内容长度（Content-Length）的情况下，系统会启用分块模式。此时，方法使用正则表达式来匹配每个分块大小行。如果某行由十六进制数字组成，且其第一个换行符（LF）前缺少回车符（CR），则正则表达式中的数字匹配部分与通配符会发生相互回

AI Predicted 7.5 Difficulty: Trivial Updated Oct 29, 2026

Possible ATT&CK Techniques 2 AI

T1499.003 · Application Exhaustion Flood T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
None	None	`< 1.23_01`	affected

Updated Oct 29, 2026

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies

Source: CVE Program / CVE List V5

Vulnerability Description

HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. In chunked mode, used when no content length is given, add() matches each chunk-size line with `/^([\da-fA-F]+).*\x0D\x0A/`. On a line of hex digits whose first LF has no CR before it, the digits and `.*` backtrack against each other, so a single add() takes time quadratic in the line's length. Nothing limits how long the line can be. A remote attacker can exhaust CPU in applications that pass chunked request bodies to HTTP::Body.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

CWE-1333

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
-	-	0 ~ 1.23_01	-

II. Public POCs for CVE-2026-116285

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116285

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-116285 (1)

🔗 https://github.com/libwww-perl/HTTP-Body/commit/954a5343d2a095b59d357f28759c5388d1169574.patch Read full article patch

Vendor Pages for CVE-2026-116285 (1)

🔗 Changes - metacpan.org Read full article release-notes

https://www.cve.org/CVERecord?id=CVE-2026-116285

IV. Related Vulnerabilities

Same weakness: CWE-1333