========================================================================
CVE-2026-116531                                      CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-116531

   Distribution:  HTTP-Body
       Versions:  before 1.23_01
       MetaCPAN:  https://metacpan.org/dist/HTTP-Body
       VCS Repo:  https://github.com/libwww-perl/HTTP-Body

HTTP::Body versions before 1.23_01 for Perl lose track of chunk
boundaries in chunked request bodies when a read ends inside a chunk

Description
-----------
HTTP::Body versions before 1.23_01 for Perl lose track of chunk
boundaries in chunked request bodies when a read ends inside a chunk.

In chunked mode, used when no content length is given, add() treats a
chunk as complete once the buffer is as long as the chunk's declared
size, but the buffer still holds the chunk-size line. When a read ends
in the last bytes of a chunk, add() takes the chunk short and parses
the leftover data as the next chunk-size line.

A remote attacker can make a chunked body never complete, hanging a
server that reads until the body is done, and may make it complete
early, leaving the remaining bytes to be read as the next request.

Problem types
-------------
- CWE-130 Improper Handling of Length Parameter Inconsistency

Solutions
---------
Upgrade to HTTP-Body 1.23_01 or later.

References
----------
https://github.com/libwww-perl/HTTP-Body/commit/5869dde9fe6d13f189a435b6583fd63fcc18677a.patch
https://metacpan.org/release/GETTY/HTTP-Body-1.24/changes