Yüksek CVSS 7.5
CVE-2026-117500: CVE-2026-117500: güvenlik açığı
Açıklama (NVD)
HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload. For every file part, the multipart parser finds the suffix of the uploaded filename by matching the default $basename_regexp, qr/[^.]+(\.[^\\\/]+)$/, against the whole basename. A basename made of many dots and ending in a backslash makes the regex backtrack in time quadratic in its length. A remote attacker can exhaust CPU with one request, as a basename of about 32 KB takes several seconds to match and every file part is matched separately.
Özet bilgiler
- CVSS v3.1
- 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - EPSS
- %0,45 (yüzdelik 39)
- CWE
- CWE-1333
- Yama
- Yok / bilinmiyor