Quick answers
- Is CVE-2026-116285 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-116285 being exploited in the wild.
- How severe is CVE-2026-116285?
- Informational severity, published 28 October 2026.
- Which products and versions are affected?
- CPAN HTTP::Body before 1.23_01.
- Is there a fix for CVE-2026-116285?
- Yes: fixed in HTTP::Body 1.23_01. Until then: Restrict HTTP request size limits and chunk header length limits at the web server or reverse proxy layer; disable chunked transfer encoding if not required by the application. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-116285 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-116285?
- Check whether you run CPAN HTTP::Body at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: HTTP::Body 1.23_01
Restrict HTTP request size limits and chunk header length limits at the web server or reverse proxy layer; disable chunked transfer encoding if not required by the application.
Technical details
The vulnerability stems from quadratic regex backtracking in the chunk-size line parser. The regex `/^([\da-fA-F]+).*\x0D\x0A/` uses greedy matching on `.*` which, when processing a line of hex digits lacking a proper CRLF terminator, causes exponential backtracking between the captured digits and the wildcard. A remote attacker can send an HTTP request with a chunked Transfer-Encoding header and a malformed size line (e.g., 100 KB of digits followed by LF only) to trigger quadratic-time parsing, consuming CPU resources proportionally to the square of the line length.
Affected products
- CPAN HTTP::Body before 1.23_01
Timeline
- 2026-10-28: disclosed