CVE-2026-116131
Description
A flaw was found in HTTP::Body. The module fails to limit the number of form fields or multipart parts processed in incoming request bodies. A remote attacker can exploit this vulnerability by sending a specially crafted request containing an excessive number of separators or file parts. This can exhaust system memory or create large numbers of temporary files, resulting in a Denial of Service (DoS).
Statement
This vulnerability is rated as an Important severity because unauthenticated remote attackers can trigger a denial of service without requiring privileges or prior authentication. In Red Hat environments, the perl-HTTP-Body module is used by Perl-based web services to process HTTP request payloads. Because the parser does not restrict the volume of incoming payload fields or parts, processing malicious requests can exhaust worker memory or fill storage with temporary files, causing the hosting web application to crash or become unresponsive.
Mitigation
Set $HTTP::Body::UrlEncoded::max_params / $HTTP::Body::MultiPart::max_parts to a low value to limit the number of form fields and multipart parts processed (upstream fix commit 47beca52; default 1000, 0/undef disables).
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
