Infinite Loop Vulnerability in CGI for Perl Versions Prior to 5.00

CVE-2026-120651

What is CVE-2026-120651?

A vulnerability in CGI for Perl allows an infinite loop condition when handling a short request body, specifically under the configuration where uploads are disabled. When the environment variable $CGI::DISABLE_UPLOADS is set and a request is made with a body shorter than the declared Content-Length, the server continues to read indefinitely, unable to terminate the request. This not only exhausts server resources but can also lead to denial-of-service scenarios, as the client can exploit this behavior to keep the server process running indefinitely.

References