HTTP::Body older versions parse the trailer section of an HTTP request by scanning all header fields of the same name in a quadratic‑time algorithm. The time to parse grows proportionally to the square of the number of these header fields or trailer lines. A single HTTP request that contains a large number of trailer entries can therefore consume several seconds of CPU. The consequence is a denial‑of‑service condition caused by resource exhaustion; all processes that rely on HTTP::Body can be slowed or halted by a single malicious request. The weakness is a CWE‑770 style resource exhaustion problem.

The affected module is the Perl HTTP::Body package, specifically any installation older than version 1.24_02. The module is used by Perl web applications and frameworks that parse HTTP requests. Users who cannot immediately update should be aware that only the HTTP::Body component is vulnerable; other related Perl libraries are not impacted. The fix is available in HTTP::Body 1.24_02 and later, which introduces limits on the size and number of trailer lines to avoid quadratic parsing.

No EPSS score is available and the vulnerability is not listed in CISA KEV, but the remote attack vector is clear: an unauthenticated attacker can send a crafted HTTP request that exploits the parsing algorithm. The simplicity of the attack combined with the lack of mitigations in older binaries makes exploitation highly likely in an exposed environment. The risk is effectively an unbounded CPU consumption leading to service degradation.