{"id":"CVE-2026-117500","aliases":[],"cve":{"records":[{"id":"CVE-2026-117500","source":"CPANSec","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-27T08:44:49.796Z","published":"2026-10-28T17:17:11.051Z","modified":"2026-10-28T17:17:11.051Z"}],"publishers":[{"name":"CPANSec","role":"CNA","organizationId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","modified":"2026-10-28T17:17:11.051Z"}],"references":[{"url":"https://github.com/libwww-perl/HTTP-Body/commit/9ab46daaede02fb13ea55a7e3ede34c8b918d8ca.patch","tags":["patch"],"source":"CPANSec"},{"url":"https://github.com/libwww-perl/HTTP-Body/commit/3abc958d78bd84bf4abb87bad79b9432eab7e694.patch","tags":["patch"],"source":"CPANSec"},{"url":"https://metacpan.org/release/GETTY/HTTP-Body-1.24_01/changes","tags":["release-notes"],"source":"CPANSec"}],"weaknesses":[{"id":"CWE-1333","description":"CWE-1333 Inefficient Regular Expression Complexity","source":"CPANSec"}],"applicability":[],"prioritization":[]},"title":"HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload","titleSource":"CPANSec","descriptionSource":"CPANSec","description":"HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload.\n\nFor every file part, the multipart parser finds the suffix of the uploaded filename by matching the default $basename_regexp, qr/[^.]+(\\.[^\\\\\\/]+)$/, against the whole basename. A basename made of many dots and ending in a backslash makes the regex backtrack in time quadratic in its length.\n\nA remote attacker can exhaust CPU with one request, as a basename of about 32 KB takes several seconds to match and every file part is matched separately.","score":null,"severity":"unknown","published":"2026-10-28T17:17:11.051Z","modified":"2026-10-28T17:17:11.051Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"","name":"HTTP-Body","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"1.24_01","versionType":"custom"}],"defaultStatus":"unaffected","packageURL":"pkg:cpan/HTTP-Body","cpes":[],"source":"CPANSec","url":"https://www.cve.org/CVERecord?id=CVE-2026-117500"}],"remediation":[{"text":"Upgrade to HTTP-Body 1.24_01 or later.","source":"CPANSec","url":"https://www.cve.org/CVERecord?id=CVE-2026-117500"}],"references":["https://github.com/libwww-perl/HTTP-Body/commit/9ab46daaede02fb13ea55a7e3ede34c8b918d8ca.patch","https://github.com/libwww-perl/HTTP-Body/commit/3abc958d78bd84bf4abb87bad79b9432eab7e694.patch","https://metacpan.org/release/GETTY/HTTP-Body-1.24_01/changes"],"sources":[{"name":"CVE","id":"CVE-2026-117500","modified":"2026-10-28T17:17:11.051Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-117500"}],"assessments":[],"sourceAffected":[],"observedAt":"2026-10-29T14:35:49.114Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T11:20:32.820Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"HTTP::Body versions before 1.24_01 for Perl are vulnerable to CPU exhaustion via regex backtracking on the filename of a multipart upload, allowing a remote attacker to exhaust CPU with one request. The weakness is caused by inefficient regular expression complexity. A basename with many dots and a backslash can cause the regex to backtrack, leading to CPU exhaustion.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:09:33.910Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-117500"}]}}