https://bugzilla.redhat.com/show_bug.cgi?id=2566095
Bug ID: 2566095
Summary: CVE-2026-116132 perl-HTTP-Body: HTTP::Body: Denial of
Service via incomplete multipart uploads
[fedora-rawhide]
Product: Fedora
Version: rawhide
Status: NEW
Whiteboard: {"flaws": ["c565e569-7455-4e72-9814-43c6b0ce10fd"]}
Component: perl-HTTP-Body
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
CC: [email protected], [email protected]
Blocks: 2563028 (CVE-2026-116132)
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an
incomplete multipart upload on disk.
The multipart parser creates a temporary file as soon as a file part starts,
but adds it to the upload list only when the part completes. Uploads are only
ever deleted from that list, by the cleanup option or by the caller, so a body
that ends inside a file part leaves its temporary file where nothing can find
it.
A remote attacker can fill the temporary directory by repeating such requests,
leaving one file behind for each.
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2563028
[Bug 2563028] CVE-2026-116132 perl-http-body: HTTP::Body: Denial of Service via
incomplete multipart uploads
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2566095
Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-spam&short_desc=Report%20of%20Bug%202566095%23c0
--
_______________________________________________
perl-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
