CVE-2026-117500
Description
A flaw was found in HTTP::Body. A remote attacker could cause a Denial of Service (DoS) by submitting a specially crafted multipart upload request with a malformed filename. Inefficient regular expression processing causes excessive backtracking when parsing the filename, which exhausts CPU resources and degrades system responsiveness.
Statement
This vulnerability is rated as Moderate severity because an unauthenticated remote attacker can induce excessive CPU consumption leading to service degradation, without the ability to compromise confidentiality or execute arbitrary code. In typical Red Hat deployments, perl-HTTP-Body is not included in core Red Hat Enterprise Linux repositories and is only present via community sources such as EPEL. The risk is limited to environments running custom Perl web applications that parse untrusted multipart file uploads.
Mitigation
Upgrade to HTTP::Body 1.24_01 or later. Workaround: set $file_temp_suffix or override $basename_regexp to avoid quadratic backtracking on multipart filenames.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU)
Attackers can create crafted inputs that intentionally cause the regular expression to use excessive backtracking in a way that causes the CPU consumption to spike.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
