# CVE-2026-116285: HTTP::Body regex denial of service in chunked request parsing

Source: https://junglewise.ai/threats/cve-2026-116285-http-body-versions-before-1-23-01-for-perl-allow-cpu-exhaustion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-116285 · Severity: info · Published 2026-10-28

HTTP::Body is a Perl library that parses HTTP request bodies for web frameworks and applications. A flaw in its chunked transfer encoding parser allows attackers to cause CPU exhaustion by sending specially crafted requests with malformed chunk headers, potentially blocking the server from processing legitimate traffic.

Vendors: [CPAN](https://junglewise.ai/threats/vendors/cpan).

## Quick answers

**Is CVE-2026-116285 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116285 being exploited in the wild.

**How severe is CVE-2026-116285?** Informational severity, published 28 October 2026.

**Which products and versions are affected?** CPAN HTTP::Body before 1.23_01.

**Is there a fix for CVE-2026-116285?** Yes: fixed in HTTP::Body 1.23_01. Until then: Restrict HTTP request size limits and chunk header length limits at the web server or reverse proxy layer; disable chunked transfer encoding if not required by the application. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116285 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-116285?** Check whether you run CPAN HTTP::Body at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in HTTP::Body 1.23_01

Restrict HTTP request size limits and chunk header length limits at the web server or reverse proxy layer; disable chunked transfer encoding if not required by the application.

## Technical details

The vulnerability stems from quadratic regex backtracking in the chunk-size line parser. The regex `/^([\da-fA-F]+).*\x0D\x0A/` uses greedy matching on `.*` which, when processing a line of hex digits lacking a proper CRLF terminator, causes exponential backtracking between the captured digits and the wildcard. A remote attacker can send an HTTP request with a chunked Transfer-Encoding header and a malformed size line (e.g., 100 KB of digits followed by LF only) to trigger quadratic-time parsing, consuming CPU resources proportionally to the square of the line length.

## Affected products

- CPAN HTTP::Body before 1.23_01

## Timeline

- 2026-10-28: disclosed

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/libwww-perl/HTTP-Body/commit/954a5343d2a095b59d357f28759c5388d1169574.patch](https://github.com/libwww-perl/HTTP-Body/commit/954a5343d2a095b59d357f28759c5388d1169574.patch)

## Related threats

- [HTTP::Body memory exhaustion in multipart header parsing](https://junglewise.ai/threats/cve-2026-116134-http-body-versions-before-1-23-01-for-perl-allow-memory)