Is CVE-2026-116131 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116131 being exploited in the wild.

How severe is CVE-2026-116131?

Informational severity, published 28 October 2026.

Which products and versions are affected?

Libwww-Perl HTTP::Body before 1.23_01.

Is there a fix for CVE-2026-116131?

Yes: fixed in HTTP::Body 1.23_01. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-116131 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-116131?

Check whether you run Libwww-Perl HTTP::Body at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116131: HTTP::Body request body denial of service via field count exhaustion

CVE-2026-116131 · Severity: info · Published 2026-10-28

HTTP::Body is a Perl library for parsing HTTP request bodies, commonly used by web application frameworks to handle form submissions and file uploads. Before version 1.23_01, it did not limit the number of form fields or multipart parts, allowing an attacker to exhaust worker process memory or fill the server with temporary files by sending a request with thousands of fields or parts. This can cause denial of service by making the application unresponsive or crashing worker processes.

Technologies: Libwww-Perl HTTP::Body. Vendors: Libwww-Perl.

Quick answers

Is CVE-2026-116131 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116131 being exploited in the wild.
How severe is CVE-2026-116131?: Informational severity, published 28 October 2026.
Which products and versions are affected?: Libwww-Perl HTTP::Body before 1.23_01.
Is there a fix for CVE-2026-116131?: Yes: fixed in HTTP::Body 1.23_01. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116131 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-116131?: Check whether you run Libwww-Perl HTTP::Body at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: HTTP::Body 1.23_01

Technical details

The vulnerability exists in two HTTP body parsers: the urlencoded parser splits the entire request body on separators before processing, consuming ~90 bytes of memory per separator byte, and the multipart parser creates a temporary file for each part with a filename attribute. Neither parser enforces limits on the number of fields (urlencoded) or parts (multipart) in a request body. An unauthenticated remote attacker can send a crafted HTTP request with many separators or multipart boundaries to exhaust worker memory or disk space. The fix adds configurable limits ($max_params and $max_parts, defaulting to 1000 each) and raises an exception when exceeded.

Affected products

libwww-perl HTTP::Body before 1.23_01

Timeline

2026-10-28: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.