Quick answers
- Is CVE-2026-116531 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-116531 being exploited in the wild.
- How severe is CVE-2026-116531?
- Informational severity, published 28 October 2026.
- Which products and versions are affected?
- Libwww-Perl HTTP::Body before 1.23_01.
- Is there a fix for CVE-2026-116531?
- Yes: fixed in HTTP::Body 1.23_01. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-116531 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-116531?
- Check whether you run Libwww-Perl HTTP::Body at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: HTTP::Body 1.23_01
Technical details
HTTP::Body's add() method fails to properly track chunk boundaries when a read operation ends mid-chunk. The vulnerable code measured the entire chunk_buffer (including the chunk-size line) against the declared chunk length; when a read split a chunk, leftover bytes were incorrectly reparsed as the next chunk-size line, causing the body parser to never reach completion. Attack vectors include network-level delivery of split chunks; no authentication or user interaction required. An attacker gains ability to hang servers awaiting request body completion or to perform HTTP request smuggling.
Affected products
- libwww-perl HTTP::Body before 1.23_01
Timeline
- 2026-10-28: disclosed