---
id: CVE-2026-116134
title: >-
  HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an
  unbounded multipart part header block
summary: >-
  HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an
  unbounded multipart part header block.


  The multipart parser takes everything up to the first blank line after a
  boundary as the part's header block, with no limi…
severity: none
cwe:
  - CWE-770
product: HTTP-Body
affected:
  - HTTP-Body < 1.23_01
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T17:15:31.799Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116134'
references:
  - url: >-
      https://github.com/libwww-perl/HTTP-Body/commit/c5d13911aabfad4a7ae4b6ee98ac2315400e5ed5.patch
  - url: 'https://metacpan.org/release/GETTY/HTTP-Body-1.24/changes'
tags:
  - cve.org
ingestedAt: '2026-10-28T18:15:46.400Z'
---

## Overview

HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart part header block.

The multipart parser takes everything up to the first blank line after a boundary as the part's header block, with no limit on its size or number of lines. Every line is stored in the part's header hash, so a block of short lines costs about 60 bytes of memory per input byte.

A remote attacker can exhaust worker memory with a single request.

## Affected

- `HTTP-Body < 1.23_01`

## Remediation

Upgrade to HTTP-Body 1.23_01 or later.