CVE-2026-116531
Description
A flaw was found in HTTP::Body. A remote attacker can cause a Denial of Service (DoS) or unexpected request processing by sending specially crafted chunked HTTP requests. This issue occurs because the module fails to properly track chunk boundaries when reading chunked request bodies. As a result, the server can hang indefinitely while waiting for the request body to complete, or prematurely parse leftover data as part of a subsequent request.
Statement
This vulnerability has been rated as having an Important severity impact by Red Hat because an unauthenticated remote attacker can exploit chunk boundary parsing issues to cause a denial of service or desynchronize request pipelines. The perl-HTTP-Body package is not distributed as part of core Red Hat Enterprise Linux releases and is present only in community repositories such as EPEL. Applications and web handlers that process chunked HTTP transfer encoding using this module are exposed to remote worker process stalls.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
