Denial of Service Vulnerability in CGI for Perl by Leejo
CVE-2026-120646

Currently unrated

Key Information:

Status
Vendor
CVE Published:
3 November 2026

What is CVE-2026-120646?

The CGI module for Perl, versions prior to 5.00, contains a vulnerability that can lead to denial of service. This occurs when the uploadInfo method dereferences its argument and proceeds to call its filename method without verifying that the argument is indeed an upload filehandle. As a result, a plain string that references a defined global variable can be treated as a symbolic reference, leading to unintended failures. This vulnerability highlights the importance of proper argument validation to prevent service disruptions.

References

https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CG...
technical-description
https://metacpan.org/release/LEEJO/CGI-5.00/changes
release-notes
https://github.com/leejo/CGI.pm/commit/a14a7decfdc18f2daf...
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.