Changes for version 1.23_01 - 2026-10-26 (TRIAL RELEASE)
- SECURITY: fixes for five issues reported by the CPAN Security Group (CPANSec), with patches by CPANSec:
- CVE-2026-116132: the temporary file of an upload that is still incomplete at DESTROY-time is now always deleted
- CVE-2026-116134: a multipart part's header block is limited to $HTTP::Body::MultiPart::max_header_size bytes (32768) and $HTTP::Body::MultiPart::max_header_lines lines (100)
- CVE-2026-116135: mixed-case percent escapes (e.g. %aB) in urlencoded bodies are decoded instead of being dropped
- CVE-2026-116133: a multipart body without a boundary or with a malformed delimiter line no longer takes quadratic time; a malformed delimiter line now croaks, and padding or an epilogue after the close delimiter is accepted
- CVE-2026-116131: urlencoded bodies are limited to $HTTP::Body::UrlEncoded::max_params fields and multipart bodies to $HTTP::Body::MultiPart::max_parts parts (1000 each)
- SECURITY: CVE-2026-116285: the chunk size line of a chunked body is matched in linear instead of quadratic time
- SECURITY: a chunked body is now framed independently of where the reads feeding add() fall; a read that split a chunk could leave the parser never reaching 'done', hanging a server that reads until done
- RT#105021: temp-file write errors in MultiPart and OctetStream are reported (croak) instead of silently truncating the stored body
- RT#123615: a NUL byte in a multipart filename is stripped
- RT#84004: the temp file of an aborted upload is cleaned up (see CVE-2026-116132 above)
- INCOMPATIBLE: add() now croaks when one of the new limits is exceeded. Raise the variable, or set it to 0 to disable that limit, if your forms need more. See NOTES in HTTP::Body.
- Moved repository from Shadowcat git to GitHub (libwww-perl/HTTP-Body)
- Updated all metadata resources to point to GitHub
- Fixed prerequisites: moved Digest::MD5 to test deps, changed HTTP::Headers to HTTP::Message
- Added README.md for GitHub
- Updated support section in documentation
Documentation
Modules
HTTP Body Parser
HTTP Body Multipart Parser
HTTP Body OctetStream Parser
HTTP Body UrlEncoded Parser
HTTP Body XForms Parser
HTTP Body XForms multipart/related submission Parser