Resource Exhaustion Vulnerability in HTML::FormFu by Perl
CVE-2026-19873

Currently unrated

Key Information:

Vendor

Perl

Status
Vendor
CVE Published:
31 August 2026

What is CVE-2026-19873?

HTML::FormFu, a Perl module, contains a flaw that permits resource exhaustion due to an unbounded repeat count from the query string in Repeatable elements. Specifically, when the counter_name is set, the repeat count is read as a positive integer without imposing any limits. This allows attackers to create a potentially massive number of clones when nested Repeatable elements are involved. As a result, a single request can lead to significant memory and CPU utilization, ultimately causing denial of service for legitimate users.

References

https://github.com/FormFu/HTML-FormFu/issues/71
issue-tracking
https://security.metacpan.org/patches/H/HTML-FormFu/2.08/...
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.