Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-117501— HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies

Quick assessment

Affected
CVE-2026-117501
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 的 HTTP::Body 模块在 1.24_01 版本之前存在内存耗尽漏洞：当处理分块（chunked）请求体时，该模块会对数据块进行无限制缓冲。 在分块模式（即未提供内容长度时启用）下， 方法会将每个数据块保留在内存中，直到所有数据块全部到达。若遇到以下情况之一，解析器将无限期等待： 某行并非合法的数据块大小行； 大小行后缺少 CRLF（回车换行）； 数据块大小超出整数表示范围。 在此类异常情况下，后续每一次调用 都会持续扩大缓冲区，最终导致内存耗尽。 远程攻击者可向将分块请求体传递给 HTTP::Bo

AI Predicted 7.5 Difficulty: Trivial

I. Basic Information for CVE-2026-117501

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies
Source: CVE Program / CVE List V5
Vulnerability Description
HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. In chunked mode, used when no content length is given, add() holds each chunk in memory until all of it has arrived. A line that is not a chunk-size line, a size line without CRLF, or a size too large to fit an integer leaves the parser waiting forever, and every later add() grows the buffer. A remote attacker can exhaust memory in applications that pass chunked request bodies to HTTP::Body.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 1.24_01 -

II. Public POCs for CVE-2026-117501

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-117501

请登录查看更多情报信息。

Other References for CVE-2026-117501 (2)

IV. Related Vulnerabilities

Same weakness: CWE-770