CVE-2026-117501 in HTTP::Body
Summary
by MITRE • 10/28/2026
HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies.
In chunked mode, used when no content length is given, add() holds each chunk in memory until all of it has arrived. A line that is not a chunk-size line, a size line without CRLF, or a size too large to fit an integer leaves the parser waiting forever, and every later add() grows the buffer.
A remote attacker can exhaust memory in applications that pass chunked request bodies to HTTP::Body.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified involves the Perl module HTTP::Body prior to version 1.24_01, specifically affecting its handling of HTTP requests utilizing the chunked transfer encoding mechanism. This issue stems from a fundamental flaw in how the parser manages memory allocation when processing request bodies that do not specify an explicit content length header. In such scenarios, the application relies on reading data until a specific termination sequence is detected. The implementation fails to enforce strict boundaries or validate the integrity of the chunked format correctly, leading to unbounded buffer growth under malicious conditions.
The technical root cause lies in the add() method's logic for accumulating chunks. When operating in chunked mode, the parser retains each incoming data segment in memory until it determines that the entire body has been received. However, if the input stream contains malformed data—such as a line that does not conform to the expected chunk-size format, a size indicator missing the required carriage return and line feed sequence, or a numeric value exceeding the capacity of an integer variable—the parser enters a state where it continues waiting for valid termination signals. Because the validation logic is insufficient, these anomalies do not trigger an immediate error or reset; instead, they cause subsequent calls to add() to append more data to the existing buffer without limit. This results in continuous memory consumption as long as the connection remains open and data is sent.
From a security perspective, this flaw represents a classic resource exhaustion vulnerability that can be exploited for Denial of Service attacks. A remote attacker can craft HTTP requests with deliberately malformed chunked bodies designed to trigger this unbounded buffering behavior. By sending such payloads, an attacker can force the target application's process to consume increasing amounts of system memory until it is exhausted or crashes. This effectively renders the service unavailable to legitimate users and may destabilize the underlying server infrastructure if multiple concurrent attacks are launched against vulnerable instances.
This vulnerability aligns with CWE-400, which describes Uncontrolled Resource Consumption, as well as CWE-789, Memory Allocation with Excessive Size Value, due to the failure to properly validate input sizes before allocation or retention in memory structures. In terms of offensive security frameworks, this exploit technique corresponds to ATT&CK T1499, Endpoint Denial of Service, specifically under the sub-category of Resource Exhaustion via Overload. The attack vector is remote and requires no authentication if the vulnerable endpoint is publicly accessible, making it a significant risk for web-facing applications relying on this Perl module.
Mitigation strategies primarily involve upgrading to HTTP::Body version 1.24_01 or later, where these parsing flaws have been addressed with stricter validation and bounded memory usage policies. For organizations unable to immediately patch the software, implementing input validation at a reverse proxy or web application firewall level can help detect and block malformed chunked requests before they reach the vulnerable backend service. Additionally, configuring server timeouts and resource limits for HTTP connections can provide an additional layer of defense by limiting the duration and memory footprint allowed per request, thereby reducing the window of opportunity for successful exploitation.