CVE-2026-116131: Allocation of Resources Without Limits or Throttling

HTTP::Body versions before 1.2301 for Perl allow memory and temporary file exhaustion via an unlimited number of form fields and multipart parts. The urlencoded parser splits the whole body on its separators at once, creating one scalar per separator before any field is stored. This costs about 9...

Linux Distros Unpatched Vulnerability : CVE-2026-116131

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTTP::Body versions before 1.2301 for Perl allow memory and temporary file exhaustion via an unlimited number of form fields and multipart parts. The urlencoded...

Linux Distros Unpatched Vulnerability : CVE-2026-117501

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTTP::Body versions before 1.2401 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. In chunked mode, used when no content leng...

Linux Distros Unpatched Vulnerability : CVE-2026-116285

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTTP::Body versions before 1.2301 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. In chunked mode, used when...

PT-2026-128338

Name of the Vulnerable Software and Affected Versions HTTP::Body versions prior to 1.23 01 Description The multipart parser creates a temporary file immediately when a file part begins, but only adds it to the upload list upon completion. Because uploads are only removed from that list via the...

PT-2026-128337

Name of the Vulnerable Software and Affected Versions HTTP::Body versions prior to 1.23 01 Description An issue exists where the software allows memory and temporary file exhaustion due to an unlimited number of form fields and multipart parts. The urlencoded parser splits the entire body on its...

PT-2026-128342

Name of the Vulnerable Software and Affected Versions HTTP::Body versions prior to 1.23 01 Description CPU exhaustion can occur when parsing chunked request bodies. In chunked mode, which is utilized when no content length is provided, the add function matches each chunk-size line using a regular...

CVE-2026-117500: Inefficient Regular Expression Complexity

HTTP::Body versions before 1.2401 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload. For every file part, the multipart parser finds the suffix of the uploaded filename by matching the default $basenameregexp, qr/^.+.^\/+$/, against the whole basename. A...

CVE-2026-116133: Inefficient Algorithmic Complexity

HTTP::Body versions before 1.2301 for Perl allow CPU exhaustion via quadratic rescanning of a multipart body with a missing or malformed boundary. Before the first part, and between parts, the multipart parser searches the whole buffered body for the next boundary. On a miss it keeps everything a...

CVE-2026-116531: Improper Handling of Length Parameter Inconsistency

HTTP::Body versions before 1.2301 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk. In chunked mode, used when no content length is given, add treats a chunk as complete once the buffer is as long as the chunk's declared size, but the buffer still...

PT-2026-128347

Name of the Vulnerable Software and Affected Versions HTTP::Body versions prior to 1.24 01 Description An issue exists where the multipart parser allows CPU exhaustion through regex backtracking during the processing of a multipart upload filename. The parser identifies the suffix of the uploaded...

Linux Distros Unpatched Vulnerability : CVE-2026-116134

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTTP::Body versions before 1.2301 for Perl allow memory exhaustion via an unbounded multipart part header block. The multipart parser takes everything up to the...

PT-2026-128340

Name of the Vulnerable Software and Affected Versions HTTP::Body versions prior to 1.23 01 Description An issue exists where the multipart parser accepts all data up to the first blank line following a boundary as the part's header block without limiting its size or the number of lines. Since eve...

p5-HTTP-Body -- multiple vulnerabilities

HTTP-Body oroject reports: Multiple security issues: SECURITY, CVE-2026-116131: urlencoded bodies are limited to $HTTP::Body::UrlEncoded::maxparams fields and multipart bodies to $HTTP::Body::MultiPart::maxparts parts 1000 each; reported and patched by CPANSec SECURITY, CVE-2026-116132: the...

Bytecode Alliance wasmtime resource management error vulnerability

Bytecode Alliance versions prior to 36.0.16, 37.0.0 through 48.0.3, and 49.0.0 through 49.0.1 contain a resource management error vulnerability. This vulnerability stems from waSTM time-wasi-http failing to enforce a write check limit on the WASIp2 outbound HTTP body, thereby allowing excessively...

RUSTSEC-2026-0313 Outgoing HTTP body write allows guest-driven host memory exhaustion

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-c9gc-w9vx-w86p For more information see the GitHub-hosted security advisory...

Outgoing HTTP body write allows guest-driven host memory exhaustion

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-c9gc-w9vx-w86p For more information see the GitHub-hosted security advisory...

A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU

Summary A malformed HTTP message using Transfer-Encoding: chunked can drive React\Http\Io\ChunkedDecoder into an infinite loop, pegging a CPU core and freezing the event loop. Because ReactPHP is single-threaded, one such message stalls the entire process for every client until it is killed. Both...

Server-Side Request Forgery (SSRF)

datamodel-code-generator is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to http.getbody in src/datamodelcodegenerator/http.py accepting --url targets and redirect chain targets without proper host/IP validation, which allows an attacker to perform server-side request...

GHSA-8QQM-FP2Q-V734 Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies

Summary A wrong policy can be an open door. You have to check input.attributes.request.http.truncatedbody in your policy. Description Incomplete fix for CVE-2026-50197: an oversized declared-Content-Length body still hands OPA an empty parsedbody, so deny-on-presence Rego policies fail OPEN while...