Is CVE-2026-116133 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116133 being exploited in the wild.

How severe is CVE-2026-116133?

Informational severity, published 28 October 2026.

Which products and versions are affected?

Libwww-Perl HTTP::Body before 1.23_01.

Is there a fix for CVE-2026-116133?

Yes: fixed in HTTP::Body 1.23_01 and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-116133 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-116133?

Check whether you run Libwww-Perl HTTP::Body at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116133: HTTP::Body Perl multipart parser CPU exhaustion via quadratic rescanning

CVE-2026-116133 · Severity: info · Published 2026-10-28

HTTP::Body is a Perl library that parses HTTP request bodies, including multipart form data commonly used in file uploads. A malformed or missing multipart boundary causes the parser to rescan the entire buffered body repeatedly, consuming CPU quadratically with the message size. An attacker can exhaust worker CPU by sending a few specially crafted requests to an application using this library.

Technologies: Libwww-Perl HTTP::Body. Vendors: Libwww-Perl.

Quick answers

Is CVE-2026-116133 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116133 being exploited in the wild.
How severe is CVE-2026-116133?: Informational severity, published 28 October 2026.
Which products and versions are affected?: Libwww-Perl HTTP::Body before 1.23_01.
Is there a fix for CVE-2026-116133?: Yes: fixed in HTTP::Body 1.23_01 and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116133 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-116133?: Check whether you run Libwww-Perl HTTP::Body at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: HTTP::Body 1.23_01 and later

Technical details

The vulnerability is a quadratic-time algorithmic flaw in multipart boundary parsing. The parse_preamble and parse_boundary functions search the entire buffer for the boundary marker on each new chunk, and retain the full buffer on unsuccessful searches. When a boundary is missing or malformed (not followed by CRLF or "--"), each incoming chunk triggers a complete re-scan from the start, resulting in O(n²) time complexity. This is a denial-of-service vulnerability exploitable via network without authentication.

Affected products

libwww-perl HTTP::Body before 1.23_01

Timeline

2026-10-28: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.