---
id: CVE-2026-116531
title: >-
  HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in
  chunked request bodies when a read ends inside a chunk
summary: >-
  HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in
  chunked request bodies when a read ends inside a chunk.


  In chunked mode, used when no content length is given, add() treats a chunk as
  complete once the buffe…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'
cvssSource: adp
cwe:
  - CWE-130
product: HTTP-Body
affected:
  - HTTP-Body < 1.23_01
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-05T21:02:43.203250Z'
published: '2026-10-28'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:02:46.517Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116531'
references:
  - url: >-
      https://github.com/libwww-perl/HTTP-Body/commit/5869dde9fe6d13f189a435b6583fd63fcc18677a.patch
  - url: 'https://metacpan.org/release/GETTY/HTTP-Body-1.24/changes'
tags:
  - cve.org
epss: 0.00288
epssPercentile: 0.21518
ingestedAt: '2026-10-28T18:15:46.401Z'
---

## Overview

HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk.

In chunked mode, used when no content length is given, add() treats a chunk as complete once the buffer is as long as the chunk's declared size, but the buffer still holds the chunk-size line. When a read ends in the last bytes of a chunk, add() takes the chunk short and parses the leftover data as the next chunk-size line.

A remote attacker can make a chunked body never complete, hanging a server that reads until the body is done, and may make it complete early, leaving the remaining bytes to be read as the next request.

## Affected

- `HTTP-Body < 1.23_01`

## Remediation

Upgrade to HTTP-Body 1.23_01 or later.