241 matches found
CVE-2026-117500
HTTP::Body versions before 1.2401 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload. For every file part, the multipart parser finds the suffix of the uploaded filename by matching the default $basenameregexp, qr/^.+.^/+$/, against the whole basename. A...
CVE-2026-117500 HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload
HTTP::Body versions before 1.2401 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload. For every file part, the multipart parser finds the suffix of the uploaded filename by matching the default $basenameregexp, qr/^.+.^\/+$/, against the whole basename. A...
CVE-2026-117500
The HTTP::Body Perl module (versions before 1.24_01 ) is vulnerable to CPU exhaustion due to inefficient regular expression backtracking. When parsing a multipart upload , the parser matches the default $basename_regexp against the uploaded filename. A specially crafted filename containing many d...
CVE-2026-117500 HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload
HTTP::Body versions before 1.2401 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload. For every file part, the multipart parser finds the suffix of the uploaded filename by matching the default $basenameregexp, qr/^.+.^\/+$/, against the whole basename. A...
CVE-2026-116531 HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk
HTTP::Body versions before 1.2301 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk. In chunked mode, used when no content length is given, add treats a chunk as complete once the buffer is as long as the chunk's declared size, but the buffer still...
CVE-2026-116531
HTTP::Body versions before 1.2301 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk. In chunked mode, used when no content length is given, add treats a chunk as complete once the buffer is as long as the chunk's declared size, but the buffer still...
CVE-2026-116531
HTTP::Body versions before 1.2301 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk. In chunked mode, used when no content length is given, add treats a chunk as complete once the buffer is as long as the chunk's declared size, but the buffer still...
EUVD-2026-112275
HTTP::Body versions before 1.2301 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk. In chunked mode, used when no content length is given, add treats a chunk as complete once the buffer is as long as the chunk's declared size, but the buffer still...
CVE-2026-116531
The HTTP::Body Perl module (versions before 1.23_01 ) is vulnerable to a flaw where it loses track of chunk boundaries in chunked request bodies if a read operation ends inside a chunk. The root cause is that the add() function treats a chunk as complete once the buffer matches the declared size,...
CVE-2026-116531 HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk
HTTP::Body versions before 1.2301 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk. In chunked mode, used when no content length is given, add treats a chunk as complete once the buffer is as long as the chunk's declared size, but the buffer still...
CVE-2026-116285
The HTTP::Body Perl module (versions before 1.23_01 ) is vulnerable to CPU exhaustion due to quadratic regex backtracking during the parsing of chunked request bodies. When a request lacks a content length, the add() function uses the regex /^([ a-fA-F]+).* / to match chunk-size lines. If a line ...
CVE-2026-116285
HTTP::Body versions before 1.2301 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. In chunked mode, used when no content length is given, add matches each chunk-size line with "/^\da-fA-F+.\x0D\x0A/". On a line of hex digits whose first LF has no...
CVE-2026-116285 HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies
HTTP::Body versions before 1.2301 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. In chunked mode, used when no content length is given, add matches each chunk-size line with /^\da-fA-F+.\x0D\x0A/. On a line of hex digits whose first LF has no C...
EUVD-2026-112274
HTTP::Body versions before 1.2301 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. In chunked mode, used when no content length is given, add matches each chunk-size line with /^\da-fA-F+.\x0D\x0A/. On a line of hex digits whose first LF has no C...
CVE-2026-116285 HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies
HTTP::Body versions before 1.2301 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. In chunked mode, used when no content length is given, add matches each chunk-size line with /^\da-fA-F+.\x0D\x0A/. On a line of hex digits whose first LF has no C...
CVE-2026-116285
HTTP::Body versions before 1.2301 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. In chunked mode, used when no content length is given, add matches each chunk-size line with /^\da-fA-F+.\x0D\x0A/. On a line of hex digits whose first LF has no C...
CVE-2026-116135 HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them
HTTP::Body versions before 1.2301 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them. The decode table holds only the all-lowercase and all-uppercase spelling of each hex pair, while the escape pattern matches either case. An escape such as %aB finds no...
CVE-2026-116135
HTTP::Body versions before 1.2301 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them. The decode table holds only the all-lowercase and all-uppercase spelling of each hex pair, while the escape pattern matches either case. An escape such as %aB finds no...
CVE-2026-116135
The HTTP::Body Perl module versions before 1.23_01 is vulnerable to a parsing discrepancy. The module incorrectly drops mixed-case percent escapes (e.g., %aB) from URL-encoded form fields instead of decoding them, because the decode table only supports all-lowercase or all-uppercase spellings. Th...
EUVD-2026-112273
HTTP::Body versions before 1.2301 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them. The decode table holds only the all-lowercase and all-uppercase spelling of each hex pair, while the escape pattern matches either case. An escape such as %aB finds no...