未評価

HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart...

CVE-2026-116134 SecPulse初出 2:15

影響パッケージ

種類	パッケージ	影響を受ける版	直った版
https://cpan.org/modules	HTTP-Body	1.23_01 未満	1.23_01

原文の説明取得元が公開している説明をそのまま載せています (多くは英語)。

HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbounded multipart part header block.

The multipart parser takes everything up to the first blank line after a boundary as the part's header block, with no limit on its size or number of lines. Every line is stored in the part's header hash, so a block of short lines costs about 60 bytes of memory per input byte.

A remote attacker can exhaust worker memory with a single request.

出典: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

参照URL

web github.com
web metacpan.org
web nvd.nist.gov
web github.com