Bug 2566095

Summary: CVE-2026-116132 perl-HTTP-Body: HTTP::Body: Denial of Service via incomplete multipart uploads [fedora-rawhide]
Product: [Fedora] Fedora Reporter: Oleg Sushchenko <osushche>
Component: perl-HTTP-BodyAssignee: Tom "spot" Callaway <spotrh>
Status: NEW --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: high    
Version: rawhideCC: perl-devel, spotrh
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["c565e569-7455-4e72-9814-43c6b0ce10fd"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2563028    

Description Oleg Sushchenko 2026-11-03 18:21:19 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk.

The multipart parser creates a temporary file as soon as a file part starts, but adds it to the upload list only when the part completes. Uploads are only ever deleted from that list, by the cleanup option or by the caller, so a body that ends inside a file part leaves its temporary file where nothing can find it.

A remote attacker can fill the temporary directory by repeating such requests, leaving one file behind for each.