{"id":"CVE-2026-121006","published":"2026-11-06T08:17:19.827","lastModified":"2026-11-06T08:17:19.827","description":"HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time.\n\nEverything after the last chunk in the same call to add() is parsed with HTTP::Headers, which takes time quadratic in the number of fields of one name.  For example, it takes several seconds to parse 16 KiB of \"a:\" lines.\n\nA remote attackercan exhause the CPU with a single request.\n\nHTTP::Body version 1.25 limits the size and number of lines in the trailer.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-770"],"vendors":[],"products":[],"references":[{"url":"https://github.com/libwww-perl/HTTP-Body/commit/983dd4ca3b863ab513240b02c91c3114fb299389.patch","tags":[]},{"url":"https://metacpan.org/release/GETTY/HTTP-Body-1.24_02/changes","tags":[]}],"exploitRefs":[{"url":"https://github.com/libwww-perl/HTTP-Body/commit/983dd4ca3b863ab513240b02c91c3114fb299389.patch","tags":[]}],"hasPoc":true,"ai":null}