HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk.
The multipart parser creates a temporary file as soon as a file part starts, but adds it to the upload list only when the part completes. Uploads are only ever deleted from that list, by the cleanup option or by the caller, so a body that ends inside a file part leaves its temporary file where nothing can find it.
A remote attacker can fill the temporary directory by repeating such requests, leaving one file behind for each.
The multipart parser creates a temporary file as soon as a file part starts, but adds it to the upload list only when the part completes. Uploads are only ever deleted from that list, by the cleanup option or by the caller, so a body that ends inside a file part leaves its temporary file where nothing can find it.
A remote attacker can fill the temporary directory by repeating such requests, leaving one file behind for each.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
Advisories
No advisories yet.
Fixes
Solution
Upgrade to HTTP-Body 1.23_01 or later.
Workaround
No workaround given by the vendor.
References
History
Wed, 28 Oct 2026 17:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk. The multipart parser creates a temporary file as soon as a file part starts, but adds it to the upload list only when the part completes. Uploads are only ever deleted from that list, by the cleanup option or by the caller, so a body that ends inside a file part leaves its temporary file where nothing can find it. A remote attacker can fill the temporary directory by repeating such requests, leaving one file behind for each. | |
| Title | HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incomplete multipart upload on disk | |
| Weaknesses | CWE-459 | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-10-28T17:15:00.711Z
Reserved: 2026-10-25T11:14:04.979Z
Link: CVE-2026-116132
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-28T18:17:12.347
Modified: 2026-10-28T18:17:12.347
Link: CVE-2026-116132
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-28T18:30:15Z
Weaknesses