CVE-2026-116134
Description
A flaw was found in perl-http-body. The multipart request parser does not restrict the size or number of lines within a part's header block before storing them in memory. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request with an excessively large multipart header block, leading to memory exhaustion and causing a Denial of Service (DoS).
Statement
Red Hat has rated this vulnerability as having an Important severity because an unauthenticated remote attacker can exhaust application memory and crash worker processes handling multipart HTTP data without requiring authentication or interaction. The affected package is not distributed within core Red Hat Enterprise Linux, but is packaged in EPEL and Fedora for Perl web service ecosystems. Deployments running web applications that rely on this library to parse untrusted file uploads or form submissions are exposed to service outages.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
