{"affected":[{"defaultStatus":"unaffected","ecosystem":"cpan","packageName":"HTTP-Body","product":"","source":"CNA: CPANSec","vendor":"","versions":[{"lessThan":"1.24_02","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-121006","cwes":["CWE-770"],"description":"HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time.\n\nEverything after the last chunk in the same call to add() is parsed with HTTP::Headers, which takes time quadratic in the number of fields of one name.  For example, it takes several seconds to parse 16 KiB of \"a:\" lines.\n\nA remote attackercan exhause the CPU with a single request.\n\nHTTP::Body version 1.25 limits the size and number of lines in the trailer.","epss":null,"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793951243570,"publishedAt":1793951243570,"references":[{"source":"CNA: CPANSec","tags":["release-notes"],"url":"https://metacpan.org/release/GETTY/HTTP-Body-1.24_02/changes"},{"source":"CNA: CPANSec","tags":["patch"],"url":"https://github.com/libwww-perl/HTTP-Body/commit/983dd4ca3b863ab513240b02c91c3114fb299389.patch"}],"remediation":[{"kind":"fix","source":"CNA: CPANSec","text":"Upgrade to HTTP::Body version 1.24_02 or later."},{"kind":"fix","source":"CNA: CPANSec","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/libwww-perl/HTTP-Body/commit/983dd4ca3b863ab513240b02c91c3114fb299389.patch"}],"revision":"2206bbf241df38a190dcde88dd23415edd82062b796211914ffdc27578972416","sources":[{"modifiedAt":1793951243570,"name":"CNA: CPANSec","retrievedAt":1793952522519,"url":"https://www.cve.org/CVERecord?id=CVE-2026-121006"}],"ssvc":null,"status":"published","title":"HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time","updatedAt":1793952522519}