Denial of Service in CGI::Cookie for Perl by LEEJO
CVE-2026-120631

Currently unrated

Key Information:

Status
Vendor
CVE Published:
3 November 2026

What is CVE-2026-120631?

The CGI::Cookie component in Perl versions 4.67 to 4.99 is prone to a denial of service result due to the unsafe handling of the client cookie's expires value. The interpolation of this value into a regex pattern allows attackers to craft requests that can either lead the process to crash or to cause extensive backtracking, which effectively ties up system resources. This vulnerability can be exploited through specially formulated cookies, emphasizing the need for users to update to version 5.00 or later, where this issue has been addressed.

References

https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CG...
technical-description
https://metacpan.org/release/LEEJO/CGI-5.00/changes
release-notes
https://github.com/leejo/CGI.pm/commit/95e044af2ec24d99a6...
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.