CVE-2026-117500— HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload

Quick assessment

Affected

CVE-2026-117500

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 语言中 HTTP::Body 模块在 1.24_01 版本之前的版本存在漏洞，攻击者可利用 multipart 上传文件名的正则回溯导致 CPU 资源耗尽。对于 multipart 上传中的每个文件部分，解析器会尝试使用默认的正则表达式（即）在整个文件基本名上匹配，以提取上传文件名的后缀。若构造一个由大量点号组成且以反斜杠结尾的基本名，该正则表达式在匹配时将产生与文件名长度平方成正比的时间复杂度回溯。远程攻击者仅需发送一次请求即可耗尽服务器 CPU 资源：一个约 32 KB 的基本名需要数秒才能完

AI Predicted 7.5 Difficulty: Trivial Updated Oct 29, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
None	None	`< 1.24_01`	affected

Updated Oct 29, 2026

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload

Source: CVE Program / CVE List V5

Vulnerability Description

HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload. For every file part, the multipart parser finds the suffix of the uploaded filename by matching the default $basename_regexp, qr/[^.]+(\.[^\\\/]+)$/, against the whole basename. A basename made of many dots and ending in a backslash makes the regex backtrack in time quadratic in its length. A remote attacker can exhaust CPU with one request, as a basename of about 32 KB takes several seconds to match and every file part is matched separately.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

CWE-1333

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
-	-	0 ~ 1.24_01	-

II. Public POCs for CVE-2026-117500

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-117500

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-117500 (2)

Other References for CVE-2026-117500 (1)

https://metacpan.org/release/GETTY/HTTP-Body-1.24_01/changes release-notes

https://www.cve.org/CVERecord?id=CVE-2026-117500

IV. Related Vulnerabilities

Same weakness: CWE-1333