CVE-2026-116285
Description
A flaw was found in HTTP::Body. A remote attacker can cause a Denial of Service (DoS) through excessive CPU consumption by submitting specially crafted chunked HTTP requests. This issue occurs due to quadratic regular expression backtracking when the parser processes malformed chunk-size lines.
Statement
Red Hat has evaluated this vulnerability as an Important severity flaw because an unauthenticated remote attacker can cause extensive CPU resource exhaustion with low attack complexity. Applications parsing untrusted HTTP request bodies via this Perl module can be rendered completely unresponsive, preventing the service from handling legitimate incoming requests. The perl-HTTP-Body package is not shipped in core Red Hat Enterprise Linux and is only available through community repositories such as EPEL.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
