HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.24_01
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
HTTP::Body, a Perl module for parsing HTTP request bodies, is affected, so applications that handle multipart file uploads with it can be impacted. A remote attacker can send a single crafted upload with a specially constructed filename that makes the parser consume excessive CPU time, potentially slowing or denying service to the application.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload. For every file part, the multipart parser finds the suffix of the uploaded filename by matching the default $basename_regexp, qr/[^.]+(\.[^\\\/]+)$/, against the whole basename. A basename made of many dots and ending in a backslash makes the regex backtrack in time quadratic in its length. A remote attacker can exhaust CPU with one request, as a basename of about 32 KB takes several seconds to match and every file part is matched separately.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- HTTP-Body
fixed in 1.24_01