For every file part, the multipart parser finds the suffix of the uploaded filename by matching the default $basename_regexp, qr/[^.]+(\.[^\\\/]+)$/, against the whole basename. A basename made of many dots and ending in a backslash makes the regex backtrack in time quadratic in its length.
A remote attacker can exhaust CPU with one request, as a basename of about 32 KB takes several seconds to match and every file part is matched separately.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
| Vendors | Products |
|---|---|
|
Libwww-perl
Subscribe
|
Http-body
Subscribe
|
No advisories yet.
Solution
Upgrade to HTTP-Body 1.24_01 or later.
Workaround
No workaround given by the vendor.
Wed, 28 Oct 2026 22:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Libwww-perl
Libwww-perl http-body |
|
| Vendors & Products |
Libwww-perl
Libwww-perl http-body |
Wed, 28 Oct 2026 17:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload. For every file part, the multipart parser finds the suffix of the uploaded filename by matching the default $basename_regexp, qr/[^.]+(\.[^\\\/]+)$/, against the whole basename. A basename made of many dots and ending in a backslash makes the regex backtrack in time quadratic in its length. A remote attacker can exhaust CPU with one request, as a basename of about 32 KB takes several seconds to match and every file part is matched separately. | |
| Title | HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload | |
| Weaknesses | CWE-1333 | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-10-28T17:17:11.051Z
Reserved: 2026-10-27T08:44:49.796Z
Link: CVE-2026-117500
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-10-28T18:17:14.747
Modified: 2026-10-29T15:11:53.000
Link: CVE-2026-117500
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-28T22:10:28Z