Denial of Service in Perl CGI Versions Prior to 5.00
CVE-2026-120645

Currently unrated

Key Information:

Status
Vendor
CVE Published:
3 November 2026

What is CVE-2026-120645?

Versions of the Perl CGI library prior to 5.00 are vulnerable to denial of service through the mishandling of request parameters used in regex patterns for option group selection in the scrolling_list feature. An attacker can exploit this vulnerability by submitting crafted input that leads to either an immediate failure of the rendering process or excessive resource consumption due to backtracking regex patterns. This can result in significant disruption to the service, emphasizing the need for users to upgrade to the latest version to mitigate risks.

References

https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CG...
technical-description
https://metacpan.org/release/LEEJO/CGI-5.00/changes
release-notes
https://github.com/leejo/CGI.pm/commit/824956fbb0c4eb7704...
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.