{"id":"CVE-2026-121006","title":"HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time","summary":"HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time.\n\nEverything after the last chunk in the same call to add() is parsed with HTTP::Headers, which takes time quadratic in the number of fields of one name.  Fo…","severity":"none","cwe":["CWE-770"],"product":"HTTP-Body","affected":["HTTP-Body < 1.24_02"],"published":"2026-11-06","updated":"2026-11-06","sourceUpdated":"2026-11-06T19:05:07.229Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-121006","references":[{"url":"https://metacpan.org/release/GETTY/HTTP-Body-1.24_02/changes"},{"url":"https://github.com/libwww-perl/HTTP-Body/commit/983dd4ca3b863ab513240b02c91c3114fb299389.patch"}],"tags":["cve.org"],"epss":0.00225,"epssPercentile":0.13195,"ingestedAt":"2026-11-06T08:48:01.714Z","slug":"CVE-2026-121006","body":"## Overview\n\nHTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time.\n\nEverything after the last chunk in the same call to add() is parsed with HTTP::Headers, which takes time quadratic in the number of fields of one name.  For example, it takes several seconds to parse 16 KiB of \"a:\" lines.\n\nA remote attackercan exhause the CPU with a single request.\n\nHTTP::Body version 1.25 limits the size and number of lines in the trailer.\n\n## Affected\n\n- `HTTP-Body < 1.24_02`\n\n## Remediation\n\nUpgrade to HTTP::Body version 1.24_02 or later.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}