CVE-2026-121006

HTTP::Body versions before 1.2402 for Perl parse the trailer in quadratic time. Everything after the last chunk in the same call to add is parsed with HTTP::Headers, which takes time quadratic in the number of fields of one name. For example, it takes several seconds to parse 16 KiB of "a:" lines...

EUVD-2026-117992

HTTP::Body versions before 1.2402 for Perl parse the trailer in quadratic time. Everything after the last chunk in the same call to add is parsed with HTTP::Headers, which takes time quadratic in the number of fields of one name. For example, it takes several seconds to parse 16 KiB of "a:" lines...

CVE-2026-121006 HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time

HTTP::Body versions before 1.2402 for Perl parse the trailer in quadratic time. Everything after the last chunk in the same call to add is parsed with HTTP::Headers, which takes time quadratic in the number of fields of one name. For example, it takes several seconds to parse 16 KiB of "a:" lines...

CVE-2026-121006

The HTTP::Body Perl module (versions before 1.24_02 ) is vulnerable to a CPU exhaustion attack because it parses the trailer in quadratic time. Specifically, data processed via the add() call is handled by HTTP::Headers , which scales quadratically relative to the number of fields with the same n...

CVE-2026-121006 HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time

HTTP::Body versions before 1.2402 for Perl parse the trailer in quadratic time. Everything after the last chunk in the same call to add is parsed with HTTP::Headers, which takes time quadratic in the number of fields of one name. For example, it takes several seconds to parse 16 KiB of "a:" lines...

UBUNTU-CVE-2026-121006

HTTP::Body versions before 1.2402 for Perl parse the trailer in quadratic time. Everything after the last chunk in the same call to add is parsed with HTTP::Headers, which takes time quadratic in the number of fields of one name. For example, it takes several seconds to parse 16 KiB of "a:" lines...

Linux Distros Unpatched Vulnerability : CVE-2026-121006

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTTP::Body versions before 1.2402 for Perl parse the trailer in quadratic time. Everything after the last chunk in the same call to add is parsed with...

POC-CVE-2022-26671

If you got here, you know why this repo needed created. CVE-2022-26671 GET /AT/ATDefault.aspx Line's 430 contains the cleartext credential. secom | supervisor In regards to to responsible disclosure, not dislcosing a hardcoded cleartext HTTP body response is silly when its the login page./...

CVE-2026-117500

A flaw was found in HTTP::Body. A remote attacker could cause a Denial of Service DoS by submitting a specially crafted multipart upload request with a malformed filename. Inefficient regular expression processing causes excessive backtracking when parsing the filename, which exhausts CPU resourc...

CVE-2026-116135

A flaw was found in HTTP::Body. When processing URL-encoded form submissions, the module removes mixed-case percent escapes instead of decoding them into their corresponding characters. A remote attacker can exploit this parsing discrepancy by submitting specially crafted requests, potentially...

CVE-2026-117501

A flaw was found in HTTP::Body. By sending crafted chunked HTTP requests with malformed chunk sizes, a remote attacker can cause the parser to continuously buffer incoming data in memory. This issue leads to excessive memory consumption, resulting in a Denial of Service DoS for the affected...

CVE-2026-116531

A flaw was found in HTTP::Body. A remote attacker can cause a Denial of Service DoS or unexpected request processing by sending specially crafted chunked HTTP requests. This issue occurs because the module fails to properly track chunk boundaries when reading chunked request bodies. As a result,...

CVE-2026-116134

A flaw was found in perl-http-body. The multipart request parser does not restrict the size or number of lines within a part's header block before storing them in memory. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request with an excessively large multipa...

CVE-2026-116132

A flaw was found in HTTP::Body. A remote attacker could cause a Denial of Service DoS by sending repeated incomplete multipart upload requests. The multipart parser creates a temporary file when a file part begins but fails to track or clean it up if the upload terminates prematurely, allowing an...

CVE-2026-116285

A flaw was found in HTTP::Body. A remote attacker can cause a Denial of Service DoS through excessive CPU consumption by submitting specially crafted chunked HTTP requests. This issue occurs due to quadratic regular expression backtracking when the parser processes malformed chunk-size lines...

CVE-2026-116133

A flaw was found in HTTP::Body. A remote attacker can cause a Denial of Service DoS by sending specially crafted HTTP requests containing missing or malformed multipart boundaries. Due to inefficient parsing, the component repeatedly rescans the buffered message body upon receiving each data chun...

CVE-2026-116131

A flaw was found in HTTP::Body. The module fails to limit the number of form fields or multipart parts processed in incoming request bodies. A remote attacker can exploit this vulnerability by sending a specially crafted request containing an excessive number of separators or file parts. This can...

SUSE CVE-2026-116131

HTTP::Body versions before 1.2301 for Perl allow memory and temporary file exhaustion via an unlimited number of form fields and multipart parts. The urlencoded parser splits the whole body on its separators at once, creating one scalar per separator before any field is stored. This costs about 9...

SUSE CVE-2026-116132

HTTP::Body versions before 1.2301 for Perl leave the temporary file of an incomplete multipart upload on disk. The multipart parser creates a temporary file as soon as a file part starts, but adds it to the upload list only when the part completes. Uploads are only ever deleted from that list, by...

SUSE CVE-2026-116133

HTTP::Body versions before 1.2301 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundary. Before the first part, and between parts, the multipart parser searches the whole buffered body for the next boundary. On a miss it keeps everything a...