UBUNTU-CVE-2026-116131

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-116131
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-116131.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-116131
Upstream
Published
2026-11-03T00:00:00Z
Modified
2026-11-04T03:30:26Z
Severity
  • Ubuntu - medium
Summary
[none]
Details

HTTP::Body versions before 1.23_01 for Perl allow memory and temporary file exhaustion via an unlimited number of form fields and multipart parts. The urlencoded parser splits the whole body on its separators at once, creating one scalar per separator before any field is stored. This costs about 90 bytes of memory per separator byte. The multipart parser creates a temporary file for every part that carries a filename. Neither parser limits how many fields or parts a body may hold. A remote attacker can exhaust worker memory with a body made of separators, or create thousands of temporary files with one request of small file parts.

References

Affected packages

Ubuntu:16.04:LTS
libhttp-body-perl

Package

Name
libhttp-body-perl
Purl
pkg:deb/ubuntu/libhttp-body-perl?arch=source&distro=xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.22-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libhttp-body-perl",
            "binary_version": "1.22-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-116131.json"
Ubuntu:18.04:LTS
libhttp-body-perl

Package

Name
libhttp-body-perl
Purl
pkg:deb/ubuntu/libhttp-body-perl?arch=source&distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.22-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libhttp-body-perl",
            "binary_version": "1.22-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-116131.json"
Ubuntu:20.04:LTS
libhttp-body-perl

Package

Name
libhttp-body-perl
Purl
pkg:deb/ubuntu/libhttp-body-perl?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.22-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libhttp-body-perl",
            "binary_version": "1.22-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-116131.json"
Ubuntu:22.04:LTS
libhttp-body-perl

Package

Name
libhttp-body-perl
Purl
pkg:deb/ubuntu/libhttp-body-perl?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.22-1.1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libhttp-body-perl",
            "binary_version": "1.22-1.1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-116131.json"
Ubuntu:24.04:LTS
libhttp-body-perl

Package

Name
libhttp-body-perl
Purl
pkg:deb/ubuntu/libhttp-body-perl?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.22-2

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libhttp-body-perl",
            "binary_version": "1.22-2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-116131.json"
Ubuntu:26.04:LTS
libhttp-body-perl

Package

Name
libhttp-body-perl
Purl
pkg:deb/ubuntu/libhttp-body-perl?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.23-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libhttp-body-perl",
            "binary_version": "1.23-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-116131.json"
Ubuntu:26.10
libhttp-body-perl

Package

Name
libhttp-body-perl
Purl
pkg:deb/ubuntu/libhttp-body-perl?arch=source&distro=stonking

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.23-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libhttp-body-perl",
            "binary_version": "1.23-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-116131.json"