Hi,

The following vulnerability was published for libhttp-body-perl.

CVE-2026-121006[0]:
| HTTP::Body versions before 1.24_02 for Perl parse the trailer in
| quadratic time.  Everything after the last chunk in the same call to
| add() is parsed with HTTP::Headers, which takes time quadratic in
| the number of fields of one name.  For example, it takes several
| seconds to parse 16 KiB of "a:" lines.  A remote attackercan exhause
| the CPU with a single request.  HTTP::Body version 1.25 limits the
| size and number of lines in the trailer.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-121006
https://www.cve.org/CVERecord?id=CVE-2026-121006
[1] https://lists.security.metacpan.org/cve-announce/msg/44934345/

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
libhttp-body-perl, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1153153@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
gregor herrmann <gregoa@debian.org> (supplier of updated libhttp-body-perl package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 06 Nov 2026 14:11:24 +0100
Source: libhttp-body-perl
Architecture: source
Version: 1.25-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org>
Changed-By: gregor herrmann <gregoa@debian.org>
Closes: 1153153
Changes:
 libhttp-body-perl (1.25-1) unstable; urgency=medium
 .
   * Import upstream version 1.24_02 as 1.24.02.
     Fixed in 1.24_02:
     - CVE-2026-121006 (chunked trailer)
     Closes: #1153153
 .
   * Import upstream version 1.25.
   * Add patch to remove warning about ambiguous length().
Checksums-Sha1:
 83d2a35e1274730245fa0db7a2eafa3c49d6fd9b 2565 libhttp-body-perl_1.25-1.dsc
 1a7008ad4fb8e896805b05f4658ed2e8b4252b96 43123 libhttp-body-perl_1.25.orig.tar.gz
 bf3fa948f87fa9a162873841c10e6bcc284790de 4984 libhttp-body-perl_1.25-1.debian.tar.xz
 0eb79c80e7530ee46e9ef7d226848ca633d2821d 121724 libhttp-body-perl_1.25-1.git.tar.xz
 7e8fa39e0e8c3875955fc2a1164dab141ac057cd 17773 libhttp-body-perl_1.25-1_source.buildinfo
Checksums-Sha256:
 ff0c676d96d1c9d8d392baf60a1e9835bac0c227a7a43667f0a519fa753dfa08 2565 libhttp-body-perl_1.25-1.dsc
 16045ae88d31e93549b144b09848a482708dad68d2ab4881ef16a9e1411b5505 43123 libhttp-body-perl_1.25.orig.tar.gz
 8514132ef5116055faeaaea71e6e237dc97d210f08cf79913bfd719bfec15f19 4984 libhttp-body-perl_1.25-1.debian.tar.xz
 ef14b45b312d903db50f131efee4dc0bcd164cd4d15cf8dbb617e6e13b2a4a36 121724 libhttp-body-perl_1.25-1.git.tar.xz
 268a4043b8c64c451fbbe2b2f05d2c65324ca10163e45891cf082c8a438ba518 17773 libhttp-body-perl_1.25-1_source.buildinfo
Files:
 9e4f048d9988bfc88eb397411a366940 2565 perl optional libhttp-body-perl_1.25-1.dsc
 9640524934da35f912d9dcb3d1fa4259 43123 perl optional libhttp-body-perl_1.25.orig.tar.gz
 831bc3beab3878a26e1e464919b1bd73 4984 perl optional libhttp-body-perl_1.25-1.debian.tar.xz
 01a899eccbccd8c46892aee0b6633eab 121724 perl None libhttp-body-perl_1.25-1.git.tar.xz
 0322022ddf414c61092989d32beaecb4 17773 perl optional libhttp-body-perl_1.25-1_source.buildinfo
Git-Tag-Info: tag=97868efc7b8837d03b84b9e115f56876199b0b53 fp=d1e1316e93a760a8104d85fabb3a68018649aa06
Git-Tag-Tagger: gregor herrmann <gregoa@debian.org>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmrt0tgACgkQYG0ITkaD
wHnWWg//b9e8i9mGPcxTPLxSMxaJHMBmwns/K3CX77cQ2DVpzNhxCfPtsZ/j6Km5
m0uASj2vaMcEhwKgyIheSt3gjJ5PaoUNMY0TGcNqh+X5kk2t2vah03phgg6y4S9y
BzUXVCJ4ONlTmZp6cfZm3hGLcvfcJ3KC3GBpgzy3Q48N3T07K7C319PCTQz/id7H
2Uqnwg8LlIYxxjrxACkbOyepxOKL97wpYeG6YPLt4Z9jc/CAo+u5fLuoQBAnTVqR
Av8qU4xVNG5spZ/vr2G9XegRM8NQMb5Gb2Uko2xV2jX4+qqp43PWnKYEn0UfHpNs
CX4CNyZp+OlNWBX19PcfSVQROwruhlcZ5bVQBdT9uSTjvRIvWD3bxs3My6T40nD0
k2htSkQtwOwCQSdSKBSjy7P/4taX7AdxeOORIB6Qr5x+y40mZYVRdUjcBrPqW8iv
33lApZYuHSESolpGfyrDMK/XjtSqj1rlc9577UbIjWVy4rYUS1M1hwOJmrxz//ns
Igfc5+geXMAVRIw3dLK2xmJInTE1szcOz8MtlRBvd0dSOCiWI2stSS3pDptzsrLz
5qH10Hey1onjqM6JCft8HzE7QxQ7Mms3pD+OUCAnYur60R77NxQ4elKIiuZIAPl7
NMC0wLBnwHgs1VCjQiEIOhYxDgJYKYUqxCHF0n+EDYrRPPQMcXE=
=RGy7
-----END PGP SIGNATURE-----