Perl CGI Library Vulnerability in RRD::CGI::Image Affects Multiple Versions

CVE-2026-123776

What is CVE-2026-123776?

The RRD::CGI::Image Perl module exhibits a vulnerability where CGI query parameters containing 'tz' are processed without proper validation. This occurs in the normalize_params method, which directly assigns the value of the 'tz' parameter to the $ENV{TZ} environment variable and subsequently calls tzset(). If the value is a path starting with '/' or ':', the glibc library attempts to open this as a file, which can lead to a process stall if the path references a FIFO or a blocking device. This flaw poses a risk as it allows for potential denial of service conditions through crafted CGI requests.

References