{"id":"UBUNTU-CVE-2026-117500","details":"HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload. For every file part, the multipart parser finds the suffix of the uploaded filename by matching the default $basename_regexp, qr/[^.]+(\\.[^\\\\\\/]+)$/, against the whole basename. A basename made of many dots and ending in a backslash makes the regex backtrack in time quadratic in its length. A remote attacker can exhaust CPU with one request, as a basename of about 32 KB takes several seconds to match and every file part is matched separately.","modified":"2026-11-04T03:30:26.256578911Z","published":"2026-11-03T00:00:00Z","upstream":["CVE-2026-117500"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-117500"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-117500"},{"type":"REPORT","url":"https://lists.security.metacpan.org/cve-announce/msg/44711935/"},{"type":"REPORT","url":"https://github.com/libwww-perl/HTTP-Body/commit/3abc958d78bd84bf4abb87bad79b9432eab7e694.patch"},{"type":"REPORT","url":"https://github.com/libwww-perl/HTTP-Body/commit/9ab46daaede02fb13ea55a7e3ede34c8b918d8ca.patch"},{"type":"REPORT","url":"https://metacpan.org/release/GETTY/HTTP-Body-1.24_01/changes"}],"affected":[{"package":{"name":"libhttp-body-perl","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/libhttp-body-perl?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22-1"],"ecosystem_specific":{"binaries":[{"binary_name":"libhttp-body-perl","binary_version":"1.22-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-117500.json"}},{"package":{"name":"libhttp-body-perl","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/libhttp-body-perl?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22-1"],"ecosystem_specific":{"binaries":[{"binary_version":"1.22-1","binary_name":"libhttp-body-perl"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-117500.json"}},{"package":{"name":"libhttp-body-perl","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/libhttp-body-perl?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22-1"],"ecosystem_specific":{"binaries":[{"binary_version":"1.22-1","binary_name":"libhttp-body-perl"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-117500.json"}},{"package":{"name":"libhttp-body-perl","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/libhttp-body-perl?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22-1.1"],"ecosystem_specific":{"binaries":[{"binary_name":"libhttp-body-perl","binary_version":"1.22-1.1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-117500.json"}},{"package":{"name":"libhttp-body-perl","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/libhttp-body-perl?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22-2"],"ecosystem_specific":{"binaries":[{"binary_name":"libhttp-body-perl","binary_version":"1.22-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-117500.json"}},{"package":{"name":"libhttp-body-perl","ecosystem":"Ubuntu:26.10","purl":"pkg:deb/ubuntu/libhttp-body-perl?arch=source&distro=stonking"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.23-1"],"ecosystem_specific":{"binaries":[{"binary_name":"libhttp-body-perl","binary_version":"1.23-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-117500.json"}},{"package":{"name":"libhttp-body-perl","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/libhttp-body-perl?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.23-1"],"ecosystem_specific":{"binaries":[{"binary_version":"1.23-1","binary_name":"libhttp-body-perl"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-117500.json"}}],"schema_version":"1.9.2","severity":[{"type":"Ubuntu","score":"medium"}]}