HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the...
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| https://cpan.org/modules | HTTP-Body |
< 1.24_01 |
1.24_01 |
Original description The description as published by the source.
HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload.
For every file part, the multipart parser finds the suffix of the uploaded filename by matching the default $basename_regexp, qr/[^.]+(.[^\/]+)$/, against the whole basename. A basename made of many dots and ending in a backslash makes the regex backtrack in time quadratic in its length.
A remote attacker can exhaust CPU with one request, as a basename of about 32 KB takes several seconds to match and every file part is matched separately.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web github.com
- web github.com
- web metacpan.org
- web nvd.nist.gov
- web github.com