---
id: CVE-2026-117501
title: >-
  HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via
  unbounded buffering of chunked request bodies
summary: >-
  HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via
  unbounded buffering of chunked request bodies.


  In chunked mode, used when no content length is given, add() holds each chunk
  in memory until all of it has arrived. …
severity: none
cwe:
  - CWE-770
product: HTTP-Body
affected:
  - HTTP-Body < 1.24_01
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T17:17:28.215Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-117501'
references:
  - url: >-
      https://github.com/libwww-perl/HTTP-Body/commit/7c6dc1ecd49e30ac405a3959c606ba389718f556.patch
  - url: 'https://metacpan.org/release/GETTY/HTTP-Body-1.24_01/changes'
tags:
  - cve.org
ingestedAt: '2026-10-28T18:15:46.399Z'
---

## Overview

HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies.

In chunked mode, used when no content length is given, add() holds each chunk in memory until all of it has arrived. A line that is not a chunk-size line, a size line without CRLF, or a size too large to fit an integer leaves the parser waiting forever, and every later add() grows the buffer.

A remote attacker can exhaust memory in applications that pass chunked request bodies to HTTP::Body.

## Affected

- `HTTP-Body < 1.24_01`

## Remediation

Upgrade to HTTP-Body 1.24_01 or later.