{"id":"CVE-2026-116285","aliases":[],"cve":{"records":[{"id":"CVE-2026-116285","source":"CPANSec","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-25T23:54:54.524Z","published":"2026-10-28T17:16:16.997Z","modified":"2026-10-28T17:16:16.997Z"}],"publishers":[{"name":"CPANSec","role":"CNA","organizationId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","modified":"2026-10-28T17:16:16.997Z"}],"references":[{"url":"https://github.com/libwww-perl/HTTP-Body/commit/954a5343d2a095b59d357f28759c5388d1169574.patch","tags":["patch"],"source":"CPANSec"},{"url":"https://metacpan.org/release/GETTY/HTTP-Body-1.24/changes","tags":["release-notes"],"source":"CPANSec"}],"weaknesses":[{"id":"CWE-1333","description":"CWE-1333 Inefficient Regular Expression Complexity","source":"CPANSec"}],"applicability":[],"prioritization":[]},"title":"HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies","titleSource":"CPANSec","descriptionSource":"CPANSec","description":"HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies.\n\nIn chunked mode, used when no content length is given, add() matches each chunk-size line with `/^([\\da-fA-F]+).*\\x0D\\x0A/`. On a line of hex digits whose first LF has no CR before it, the digits and `.*` backtrack against each other, so a single add() takes time quadratic in the line's length. Nothing limits how long the line can be.\n\nA remote attacker can exhaust CPU in applications that pass chunked request bodies to HTTP::Body.","score":null,"severity":"unknown","published":"2026-10-28T17:16:16.997Z","modified":"2026-10-28T17:16:16.997Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"","name":"HTTP-Body","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"1.23_01","versionType":"custom"}],"defaultStatus":"unaffected","packageURL":"pkg:cpan/HTTP-Body","cpes":[],"source":"CPANSec","url":"https://www.cve.org/CVERecord?id=CVE-2026-116285"}],"remediation":[{"text":"Upgrade to HTTP-Body 1.23_01 or later.","source":"CPANSec","url":"https://www.cve.org/CVERecord?id=CVE-2026-116285"}],"references":["https://github.com/libwww-perl/HTTP-Body/commit/954a5343d2a095b59d357f28759c5388d1169574.patch","https://metacpan.org/release/GETTY/HTTP-Body-1.24/changes"],"sources":[{"name":"CVE","id":"CVE-2026-116285","modified":"2026-10-28T17:16:16.997Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-116285"}],"assessments":[],"sourceAffected":[],"observedAt":"2026-10-29T14:34:58.783Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T14:10:32.801Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"HTTP::Body versions before 1.23_01 for Perl may allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies, potentially by a remote attacker. The vulnerability occurs due to inefficient regular expression complexity. A long line of hex digits can cause backtracking, taking time quadratic in the line's length.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:09:13.173Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-116285"}]}}