未評価

HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the...

CVE-2026-117500 SecPulse初出 2:17

影響パッケージ

種類	パッケージ	影響を受ける版	直った版
https://cpan.org/modules	HTTP-Body	1.24_01 未満	1.24_01

原文の説明取得元が公開している説明をそのまま載せています (多くは英語)。

HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload.

For every file part, the multipart parser finds the suffix of the uploaded filename by matching the default $basename_regexp, qr/[^.]+(.[^\/]+)$/, against the whole basename. A basename made of many dots and ending in a backslash makes the regex backtrack in time quadratic in its length.

A remote attacker can exhaust CPU with one request, as a basename of about 32 KB takes several seconds to match and every file part is matched separately.

出典: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

影響パッケージ

参照URL