========================================================================
CVE-2026-116132                                      CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-116132

   Distribution:  HTTP-Body
       Versions:  before 1.23_01
       MetaCPAN:  https://metacpan.org/dist/HTTP-Body
       VCS Repo:  https://github.com/libwww-perl/HTTP-Body

HTTP::Body versions before 1.23_01 for Perl leave the temporary file of
an incomplete multipart upload on disk

Description
-----------
HTTP::Body versions before 1.23_01 for Perl leave the temporary file of
an incomplete multipart upload on disk.

The multipart parser creates a temporary file as soon as a file part
starts, but adds it to the upload list only when the part completes.
Uploads are only ever deleted from that list, by the cleanup option or
by the caller, so a body that ends inside a file part leaves its
temporary file where nothing can find it.

A remote attacker can fill the temporary directory by repeating such
requests, leaving one file behind for each.

Problem types
-------------
- CWE-459 Incomplete Cleanup

Solutions
---------
Upgrade to HTTP-Body 1.23_01 or later.

References
----------
https://rt.cpan.org/Public/Bug/Display.html?id=84004
https://github.com/libwww-perl/HTTP-Body/commit/29e933b22ff918ccf5412d3513c885208511cfa3.patch
https://metacpan.org/release/GETTY/HTTP-Body-1.24/changes

Timeline
--------
- 2013-07-17: Issue reported.
- 2026-10-26: Version 1.23_01 released with fix.