Perl CGI Library Vulnerability Affects Versions Prior to 5.00
CVE-2026-120632

Currently unrated

Key Information:

Status
Vendor
CVE Published:
3 November 2026

What is CVE-2026-120632?

The Perl CGI library versions prior to 5.00 contain a vulnerability that allows for CPU exhaustion through a crafted POST request with a multipart/related Content-Type. This occurs due to the extraction of boundary and start parameters using an unanchored regex pattern that exploits backtracking. The implementation may process input inefficiently, leading to significant CPU resource consumption without a need for a request body. This vulnerability can potentially lead to service disruption and denial of service for users relying on these affected versions.

References

https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CG...
technical-description
https://metacpan.org/release/LEEJO/CGI-5.00/changes
release-notes
https://github.com/leejo/CGI.pm/commit/1e529c7ac8d410a51b...
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.