CVE-2026-116132
Description
A flaw was found in HTTP::Body. A remote attacker could cause a Denial of Service (DoS) by sending repeated incomplete multipart upload requests. The multipart parser creates a temporary file when a file part begins but fails to track or clean it up if the upload terminates prematurely, allowing an attacker to exhaust available disk space.
Statement
This vulnerability is rated as Important severity because unauthenticated remote attackers can exhaust filesystem storage without specialized privileges, leading to service disruption on the hosting system. Web applications utilizing this Perl module to process form submissions or file uploads are susceptible whenever multipart requests are disconnected prior to completion. In typical deployments where the temporary directory resides on the root filesystem, this storage depletion can impair co-located system services and applications.
Mitigation
Upgrade to HTTP::Body 1.23_01 or later (1.24 stable); as interim mitigation, enforce temp-directory quotas and periodic cleanup of orphaned upload temp files.
Understanding the Weakness (CWE)
Other,Confidentiality,Integrity
Technical Impact: Other; Read Application Data; Modify Application Data; DoS: Resource Consumption (Other)
It is possible to overflow the number of temporary files because directories typically have limits on the number of files allowed. This could create a denial of service problem.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
