External risk intelligence

HTTP::Body chunk boundary mishandling allows request smuggling and denial of service

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-116531

This vulnerability affects a Perl module used for parsing HTTP request bodies. Because this component is commonly integrated into web servers and application frameworks to process incoming network traffic from users, it is frequently exposed to the public internet as part of standard web application deployment patterns.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability involves how certain software handles incomplete data in web requests, potentially causing servers to hang or mishandle subsequent requests. The core issue lies in a specific Perl module's management of chunked data transmission, which is a common method for sending data over the internet when the total size is unknown beforehand. While the immediate impact is server instability, the way it affects request processing could, in certain scenarios, lead to the misinterpretation of data.

Incomplete data can cause server errors.
Affects web request processing; confirm relevance.
Assess exposure; understand potential data misinterpretation.

Attack Path

How an attacker could exploit the issue

An attacker can send a specially crafted HTTP request with a chunked body to a vulnerable web application. This request can manipulate how the application processes the body, potentially leading to unintended behavior.

Network exposure required.
Triggered by malformed chunked request body.
Server hang or request

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect servers processing chunked HTTP request bodies, potentially leading to a denial of service or request smuggling when supported by the advisory.

Server availability.
Malformed chunked requests.
Unintended request processing.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in HTTP::Body affects how chunked request bodies are parsed, potentially leading to server hangs or request desynchronization. Application owners and platform teams are likely responsible for identifying and addressing this issue. The first practical step is to determine where HTTP::Body is deployed, assess its reachability and criticality, and identify the accountable owner to plan remediation.

Application owners should own the issue.
Verify deployed instances and exposure.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the HTTP::Body module in Perl?

HTTP::Body is a Perl library designed to parse the body of HTTP requests. It is commonly used within web application frameworks and servers to process data sent by users, such as form submissions or file uploads, allowing the application to interpret that data correctly.

What does CWE-130 mean for CVE-2026-116531?

CWE-130 refers to the Improper Handling of Length Parameter Inconsistency. In the context of CVE-2026-116531, this means the software incorrectly tracks the boundaries of data chunks. Because it miscalculates where one chunk ends and the next begins, the parser can become confused, leading to data processing errors.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending a malformed HTTP request using chunked transfer encoding. If the request is crafted so that a read ends precisely within the final bytes of a chunk, the parser fails to identify boundaries correctly. It will not be triggered by requests that use a fixed Content-Length header, as chunked encoding is not involved.

Is my server vulnerable according to Halo Surface Signal?

Halo Surface Signal identifies this as a likely risk because HTTP::Body is often integrated into web frameworks that accept traffic directly from the public internet. If your application uses this component to handle incoming web requests, it is exposed to potential manipulation by remote attackers.

How do I start addressing this issue?

The first step is to locate all instances of HTTP::Body within your environment to understand where it is currently deployed. Once identified, evaluate the network exposure and criticality of those applications. Coordinate with your platform or development teams to verify the version in use and plan for an update to a patched release.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.