---
id: CVE-2026-121006
title: >-
  HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic
  time
summary: >-
  HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic
  time.


  Everything after the last chunk in the same call to add() is parsed with
  HTTP::Headers, which takes time quadratic in the number of fields of one
  name.  Fo…
severity: none
cwe:
  - CWE-770
product: HTTP-Body
affected:
  - HTTP-Body < 1.24_02
published: '2026-11-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T19:05:07.229Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121006'
references:
  - url: 'https://metacpan.org/release/GETTY/HTTP-Body-1.24_02/changes'
  - url: >-
      https://github.com/libwww-perl/HTTP-Body/commit/983dd4ca3b863ab513240b02c91c3114fb299389.patch
tags:
  - cve.org
epss: 0.00225
epssPercentile: 0.13195
ingestedAt: '2026-11-06T08:48:01.714Z'
---

## Overview

HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time.

Everything after the last chunk in the same call to add() is parsed with HTTP::Headers, which takes time quadratic in the number of fields of one name.  For example, it takes several seconds to parse 16 KiB of "a:" lines.

A remote attackercan exhause the CPU with a single request.

HTTP::Body version 1.25 limits the size and number of lines in the trailer.

## Affected

- `HTTP-Body < 1.24_02`

## Remediation

Upgrade to HTTP::Body version 1.24_02 or later.