Bug 2563038 (CVE-2026-116285)

Summary: CVE-2026-116285 perl-http-body: HTTP::Body: Denial of Service via quadratic regular expression backtracking
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in HTTP::Body. A remote attacker can cause a Denial of Service (DoS) through excessive CPU consumption by submitting specially crafted chunked HTTP requests. This issue occurs due to quadratic regular expression backtracking when the parser processes malformed chunk-size lines.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2566112, 2566113, 2566114, 2566115    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-28 17:33:53 UTC 
HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies.

In chunked mode, used when no content length is given, add() matches each chunk-size line with `/^([\da-fA-F]+).*\x0D\x0A/`. On a line of hex digits whose first LF has no CR before it, the digits and `.*` backtrack against each other, so a single add() takes time quadratic in the line's length. Nothing limits how long the line can be.

A remote attacker can exhaust CPU in applications that pass chunked request bodies to HTTP::Body.