The vulnerability arises when the Perl HTTP::Body module creates a temporary file on disk to store a file part of a multipart upload but only registers that file with the upload list once the part completes. If the upload terminates while the file part is still incomplete, the temporary file remains orphaned; an attacker can repeat this process to create many such files. This leads to denial of service through disk space exhaustion and could unintentionally expose partial file data to anyone with access to the host’s temporary directory. The weakness is listed as CWE-459, indicating an improper omission of cleanup operations.

All installations of Perl that include HTTP::Body versions older than 1.23_01 are affected, regardless of the host operating system. The temp files are written to the system’s default temporary directory, which is typically world-readable on many platforms, meaning the orphaned files can be discovered by privileged or unprivileged users alike.

Because the flaw can be triggered by any remote multipart upload request, an attacker needs only network access to the target application. The exploit is straightforward: send a multipart request that ends mid-file and repeat until the temporary directory fills. The EPSS score is not available, and the vulnerability is not in the CISA KEV catalog; however, the CVSS assessment is likely high given the potential for widespread service disruption. The lack of an automatic cleanup or caller cleanup action makes the attack viable even on systems with standard mitigations.