Memory and Resource Exhaustion Vulnerability in CGI by Leejo

CVE-2026-120650

What is CVE-2026-120650?

The CGI module for Perl prior to version 5.00 is susceptible to resource exhaustion attacks due to unchecked request size, parameter, and upload limits. With the default setting of $CGI::POST_MAX set to no limit, attackers can exploit this vulnerability by sending large requests without appropriate restrictions. This can lead to performance degradation and denial of service as the module lacks control over chunked multipart bodies and the boundary line of uploads. The absence of memory management on PUTDATA, POSTDATA, or PATCHDATA uploads compounds the issue, making it critical for users to upgrade to version 5.00 or later to safeguard their applications.

References