HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.23_01
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
HTTP::Body for Perl, used to parse HTTP request bodies, is affected in versions before 1.23_01. An attacker can send incomplete multipart uploads that leave temporary files behind on the server's disk, which can gradually fill the temporary directory.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk. The multipart parser creates a temporary file as soon as a file part starts, but adds it to the upload list only when the part completes. Uploads are only ever deleted from that list, by the cleanup option or by the caller, so a body that ends inside a file part leaves its temporary file where nothing can find it. A remote attacker can fill the temporary directory by repeating such requests, leaving one file behind for each.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- HTTP-Body
fixed in 1.23_01