Homepage

CVE-2026-117500 Affecting libhttp-body-perl package, versions *

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIANUNSTABLE-LIBHTTPBODYPERL-21781865
  • published29 Oct 2026
  • disclosed28 Oct 2026
Report a new vulnerability Found a mistake?

Introduced: 28 Oct 2026

NewCVE-2026-117500  (opens in a new tab)

How to fix?

There is no fixed version for Debian:unstable libhttp-body-perl.

NVD Description

Note: Versions mentioned in the description apply only to the upstream libhttp-body-perl package and not the libhttp-body-perl package as distributed by Debian. See How to fix? for Debian:unstable relevant fixed versions and status.

HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload.

For every file part, the multipart parser finds the suffix of the uploaded filename by matching the default $basename_regexp, qr/[^.]+(.[^\/]+)$/, against the whole basename. A basename made of many dots and ending in a backslash makes the regex backtrack in time quadratic in its length.

A remote attacker can exhaust CPU with one request, as a basename of about 32 KB takes several seconds to match and every file part is matched separately.