---
id: CVE-2026-117500
title: >-
  HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex
  backtracking on the filename of a multipart upload
summary: >-
  HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex
  backtracking on the filename of a multipart upload.


  For every file part, the multipart parser finds the suffix of the uploaded
  filename by matching the default $…
severity: none
cwe:
  - CWE-1333
product: HTTP-Body
affected:
  - HTTP-Body < 1.24_01
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T17:17:11.051Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-117500'
references:
  - url: >-
      https://github.com/libwww-perl/HTTP-Body/commit/9ab46daaede02fb13ea55a7e3ede34c8b918d8ca.patch
  - url: >-
      https://github.com/libwww-perl/HTTP-Body/commit/3abc958d78bd84bf4abb87bad79b9432eab7e694.patch
  - url: 'https://metacpan.org/release/GETTY/HTTP-Body-1.24_01/changes'
tags:
  - cve.org
ingestedAt: '2026-10-28T18:15:46.397Z'
---

## Overview

HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload.

For every file part, the multipart parser finds the suffix of the uploaded filename by matching the default $basename_regexp, qr/[^.]+(\.[^\\\/]+)$/, against the whole basename. A basename made of many dots and ending in a backslash makes the regex backtrack in time quadratic in its length.

A remote attacker can exhaust CPU with one request, as a basename of about 32 KB takes several seconds to match and every file part is matched separately.

## Affected

- `HTTP-Body < 1.24_01`

## Remediation

Upgrade to HTTP-Body 1.24_01 or later.