# CVE-2026-116133: HTTP::Body Perl multipart parser CPU exhaustion via quadratic rescanning

Source: https://junglewise.ai/threats/cve-2026-116133-http-body-versions-before-1-23-01-for-perl-allow-cpu-exhaustion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-116133 · Severity: info · Published 2026-10-28

HTTP::Body is a Perl library that parses HTTP request bodies, including multipart form data commonly used in file uploads. A malformed or missing multipart boundary causes the parser to rescan the entire buffered body repeatedly, consuming CPU quadratically with the message size. An attacker can exhaust worker CPU by sending a few specially crafted requests to an application using this library.

Technologies: [Libwww-Perl HTTP::Body](https://junglewise.ai/threats/technologies/libwww-perl-http-body). Vendors: [Libwww-Perl](https://junglewise.ai/threats/vendors/libwww-perl).

## Quick answers

**Is CVE-2026-116133 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116133 being exploited in the wild.

**How severe is CVE-2026-116133?** Informational severity, published 28 October 2026.

**Which products and versions are affected?** Libwww-Perl HTTP::Body before 1.23_01.

**Is there a fix for CVE-2026-116133?** Yes: fixed in HTTP::Body 1.23_01 and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116133 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-116133?** Check whether you run Libwww-Perl HTTP::Body at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in HTTP::Body 1.23_01 and later

## Technical details

The vulnerability is a quadratic-time algorithmic flaw in multipart boundary parsing. The parse_preamble and parse_boundary functions search the entire buffer for the boundary marker on each new chunk, and retain the full buffer on unsuccessful searches. When a boundary is missing or malformed (not followed by CRLF or "--"), each incoming chunk triggers a complete re-scan from the start, resulting in O(n²) time complexity. This is a denial-of-service vulnerability exploitable via network without authentication.

## Affected products

- libwww-perl HTTP::Body before 1.23_01

## Timeline

- 2026-10-28: disclosed

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/libwww-perl/HTTP-Body/commit/bf77eb959bbe1641b77f69eefe98d58ce4c4ec79.patch](https://github.com/libwww-perl/HTTP-Body/commit/bf77eb959bbe1641b77f69eefe98d58ce4c4ec79.patch)

## Related threats

- [HTTP::Body chunked request body parsing hang](https://junglewise.ai/threats/cve-2026-116531-http-body-versions-before-1-23-01-for-perl-lose-track-of-chunk)
- [HTTP::Body percent-escape decoding bypass in urlencoded forms](https://junglewise.ai/threats/cve-2026-116135-http-body-versions-before-1-23-01-for-perl-drop-mixed-case)
- [HTTP::Body temporary file disclosure in incomplete multipart uploads](https://junglewise.ai/threats/cve-2026-116132-http-body-versions-before-1-23-01-for-perl-leave-the-temporary)
- [HTTP::Body request body denial of service via field count exhaustion](https://junglewise.ai/threats/cve-2026-116131-http-body-versions-before-1-23-01-for-perl-allow-memory-and)