CVE-2026-116132 Affecting libhttp-body-perl package, versions *
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-DEBIANUNSTABLE-LIBHTTPBODYPERL-21781835
- published29 Oct 2026
- disclosed28 Oct 2026
Introduced: 28 Oct 2026
NewCVE-2026-116132 (opens in a new tab)How to fix?
There is no fixed version for Debian:unstable libhttp-body-perl.
NVD Description
Note: Versions mentioned in the description apply only to the upstream libhttp-body-perl package and not the libhttp-body-perl package as distributed by Debian.
See How to fix? for Debian:unstable relevant fixed versions and status.
HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk.
The multipart parser creates a temporary file as soon as a file part starts, but adds it to the upload list only when the part completes. Uploads are only ever deleted from that list, by the cleanup option or by the caller, so a body that ends inside a file part leaves its temporary file where nothing can find it.
A remote attacker can fill the temporary directory by repeating such requests, leaving one file behind for each.