CVE-2026-116131
Last modified
CVE-2026-116131 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. HTTP::Body versions before 1.23_01 for Perl allow memory and temporary file exhaustion via an unlimited number of form fields and multipart parts. The urlencoded parser splits the whole body on its separators at once, creating one scalar per separator before any field is stored. This costs about 90 bytes of memory per separator byte. EPSS estimates a 0.31% chance of exploitation in the next 30 days.
Description
HTTP::Body versions before 1.23_01 for Perl allow memory and temporary file exhaustion via an unlimited number of form fields and multipart parts. The urlencoded parser splits the whole body on its separators at once, creating one scalar per separator before any field is stored. This costs about 90 bytes of memory per separator byte. The multipart parser creates a temporary file for every part that carries a filename. Neither parser limits how many fields or parts a body may hold. A remote attacker can exhaust worker memory with a body made of separators, or create thousands of temporary files with one request of small file parts.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| — | — | < 1.23_01 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-116131?
How severe is CVE-2026-116131?
How do I fix CVE-2026-116131?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-116123A weakness has been identified in NocoDB up to 2026.07.0. Th…3.7
- CVE-2026-116124A security vulnerability has been detected in GNOME libgsf u…6.3
- CVE-2026-116127Starlet versions before 0.33 for Perl send a body in respons…9.1
- CVE-2026-116128Starlet versions from 0.20 before 0.33 for Perl allow memory…7.5
- CVE-2026-11613The Divi Ajax Filter plugin for WordPress is vulnerable to L…9.8
- CVE-2026-116130HTTP::Parser::XS versions before 0.18 for Perl truncate PATH…9.1
- CVE-2026-116132HTTP::Body versions before 1.23_01 for Perl leave the tempor…7.1
- CVE-2026-116133HTTP::Body versions before 1.23_01 for Perl allow CPU exhaus…7.5
- CVE-2026-116134HTTP::Body versions before 1.23_01 for Perl allow memory exh…7.5
- CVE-2026-116135HTTP::Body versions before 1.23_01 for Perl drop mixed-case …9.8
- CVE-2026-116136ProjectSend 2.0.0 through 2.7.1 contains an incomplete autho…5.9
- CVE-2026-116137adm-zip through 0.6.1 contains a duplicate-entry validation …3.7
Are you affected by CVE-2026-116131?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST