========================================================================
CVE-2026-117501                                      CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-117501

   Distribution:  HTTP-Body
       Versions:  before 1.24_01
       MetaCPAN:  https://metacpan.org/dist/HTTP-Body
       VCS Repo:  https://github.com/libwww-perl/HTTP-Body

HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via
unbounded buffering of chunked request bodies

Description
-----------
HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via
unbounded buffering of chunked request bodies.

In chunked mode, used when no content length is given, add() holds each
chunk in memory until all of it has arrived. A line that is not a
chunk-size line, a size line without CRLF, or a size too large to fit
an integer leaves the parser waiting forever, and every later add()
grows the buffer.

A remote attacker can exhaust memory in applications that pass chunked
request bodies to HTTP::Body.

Problem types
-------------
- CWE-770 Allocation of Resources Without Limits or Throttling

Solutions
---------
Upgrade to HTTP-Body 1.24_01 or later.

References
----------
https://github.com/libwww-perl/HTTP-Body/commit/7c6dc1ecd49e30ac405a3959c606ba389718f556.patch
https://metacpan.org/release/GETTY/HTTP-Body-1.24_01/changes