{"id":"CVE-2026-121006","aliases":["DEBIAN-CVE-2026-121006","EUVD-2026-117992","GHSA-f4c2-m2fq-wp7w","UBUNTU-CVE-2026-121006","openSUSE-SU-2026:12467-1"],"status":"published","title":"HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time","description":"HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time.\n\nEverything after the last chunk in the same call to add() is parsed with HTTP::Headers, which takes time quadratic in the number of fields of one name.  For example, it takes several seconds to parse 16 KiB of \"a:\" lines.\n\nA remote attackercan exhause the CPU with a single request.\n\nHTTP::Body version 1.25 limits the size and number of lines in the trailer.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00417,"percentile":0.36548,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2026-11-06T00:00:00Z","modified":"2026-11-10T17:33:18Z","fixes":[{"ecosystem":"Debian:14","package":"libhttp-body-perl","fixed_in":["1.25-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libhttp-body-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22-2","1.23-1","1.24.01-1","1.25-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libhttp-body-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.23-1","1.24.01-1","1.25-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libhttp-body-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25-1"}]}],"versions":["1.23-1","1.24.01-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libhttp-body-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libhttp-body-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libhttp-body-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libhttp-body-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22-1.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libhttp-body-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libhttp-body-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.23-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libhttp-body-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.23-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-HTTP-Body","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.250.0-1.1"}]}],"bundled":3}],"references":[{"url":"https://metacpan.org/release/GETTY/HTTP-Body-1.24_02/changes","tags":["release-notes","advisory","report"]},{"url":"https://github.com/libwww-perl/HTTP-Body/commit/983dd4ca3b863ab513240b02c91c3114fb299389.patch","tags":["patch","fix","report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/11/06/8","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121006","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-f4c2-m2fq-wp7w"},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/121xxx/CVE-2026-121006.json","tags":["advisory"]},{"url":"https://github.com/libwww-perl/HTTP-Body","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-121006","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-121006","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-121006","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/44934345/","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-117501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-121006","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-121006","title":"HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time","description":"HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time.\n\nEverything after the last chunk in the same call to add() is parsed with HTTP::Headers, which takes time quadratic in the number of fields of one name.  For example, it takes several seconds to parse 16 KiB of \"a:\" lines.\n\nA remote attackercan exhause the CPU with a single request.\n\nHTTP::Body version 1.25 limits the size and number of lines in the trailer.","status":"published","published":"2026-11-06T07:47:23.57Z","modified":"2026-11-10T17:33:18.232Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-770"],"updated_at":"2026-11-10T18:39:46.830944Z"}],"euvd":[{"id":"EUVD-2026-117992","description":"HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time.\n\nEverything after the last chunk in the same call to add() is parsed with HTTP::Headers, which takes time quadratic in the number of fields of one name.  For example, it takes several seconds to parse 16 KiB of \"a:\" lines.\n\nA remote attackercan exhause the CPU with a single request.\n\nHTTP::Body version 1.25 limits the size and number of lines in the trailer.","status":"published","published":"2026-11-06T07:47:23Z","modified":"2026-11-10T17:33:18Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-10T18:21:55.054764Z"}],"ghsa":[{"id":"GHSA-f4c2-m2fq-wp7w","title":"HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time.\n\nEverything...","description":"HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time.\n\nEverything after the last chunk in the same call to add() is parsed with HTTP::Headers, which takes time quadratic in the number of fields of one name.  For example, it takes several seconds to parse 16 KiB of \"a:\" lines.\n\nA remote attackercan exhause the CPU with a single request.\n\nHTTP::Body version 1.25 limits the size and number of lines in the trailer.","status":"published","published":"2026-11-06T09:31:31Z","modified":"2026-11-10T18:31:18Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-10T18:56:09.133019Z"}],"nvd":[{"id":"CVE-2026-121006","description":"HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time.\n\nEverything after the last chunk in the same call to add() is parsed with HTTP::Headers, which takes time quadratic in the number of fields of one name.  For example, it takes several seconds to parse 16 KiB of \"a:\" lines.\n\nA remote attackercan exhause the CPU with a single request.\n\nHTTP::Body version 1.25 limits the size and number of lines in the trailer.","status":"published","published":"2026-11-06T08:17:19.827Z","modified":"2026-11-12T20:07:11.09Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-10T20:21:08.785416Z"}],"osv":[{"id":"CVE-2026-121006","title":"HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time","description":"HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time.\n\nEverything after the last chunk in the same call to add() is parsed with HTTP::Headers, which takes time quadratic in the number of fields of one name.  For example, it takes several seconds to parse 16 KiB of \"a:\" lines.\n\nA remote attackercan exhause the CPU with a single request.\n\nHTTP::Body version 1.25 limits the size and number of lines in the trailer.","status":"published","published":"2026-11-06T07:47:23.57Z","modified":"2026-11-12T02:30:57.569620038Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-11T03:21:33.293332Z"},{"id":"DEBIAN-CVE-2026-121006","description":"HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time.  Everything after the last chunk in the same call to add() is parsed with HTTP::Headers, which takes time quadratic in the number of fields of one name.  For example, it takes several seconds to parse 16 KiB of \"a:\" lines.  A remote attackercan exhause the CPU with a single request.  HTTP::Body version 1.25 limits the size and number of lines in the trailer.","status":"published","published":"2026-11-06T08:17:19.827Z","modified":"2026-11-11T10:00:47.221036712Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-11T10:35:16.464644Z"},{"id":"openSUSE-SU-2026:12467-1","title":"perl-HTTP-Body-1.250.0-1.1 on GA media","description":"These are all security issues fixed in the perl-HTTP-Body-1.250.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-11-06T00:00:00Z","modified":"2026-11-07T17:23:15.977731812Z","updated_at":"2026-11-07T17:50:39.727056Z"},{"id":"UBUNTU-CVE-2026-121006","description":"HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time. Everything after the last chunk in the same call to add() is parsed with HTTP::Headers, which takes time quadratic in the number of fields of one name.  For example, it takes several seconds to parse 16 KiB of \"a:\" lines. A remote attackercan exhause the CPU with a single request. HTTP::Body version 1.25 limits the size and number of lines in the trailer.","status":"published","published":"2026-11-06T00:00:00Z","modified":"2026-11-07T01:46:04.725764619Z","updated_at":"2026-11-07T01:57:06.567161Z"}]}}