---
id: CVE-2026-116133
title: >-
  HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic
  rescanning of a multipart body with a missing or malformed boundary
summary: >-
  HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic
  rescanning of a multipart body with a missing or malformed boundary.


  Before the first part, and between parts, the multipart parser searches the
  whole buffer…
severity: none
cwe:
  - CWE-407
product: HTTP-Body
affected:
  - HTTP-Body < 1.23_01
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T17:15:16.522Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116133'
references:
  - url: >-
      https://github.com/libwww-perl/HTTP-Body/commit/bf77eb959bbe1641b77f69eefe98d58ce4c4ec79.patch
  - url: 'https://metacpan.org/release/GETTY/HTTP-Body-1.24/changes'
tags:
  - cve.org
ingestedAt: '2026-10-28T18:15:46.398Z'
---

## Overview

HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundary.

Before the first part, and between parts, the multipart parser searches the whole buffered body for the next boundary. On a miss it keeps everything and searches again from the start when the next chunk arrives. A body with no boundary, or with a delimiter followed by neither CRLF nor "--", is therefore rescanned on every chunk, taking time quadratic in its size.

A remote attacker can exhaust worker CPU with a few such requests.

## Affected

- `HTTP-Body < 1.23_01`

## Remediation

Upgrade to HTTP-Body 1.23_01 or later.