CGI versions before 5.00 for Perl (20 CVEs)
20 CVEs in CGI and CGI::Cookie for Perl before 5.00 allow denial of service, CPU exhaustion and header spoofing.
45
CVE-2026-120632
CPU exhaustion via backtracking regex in Perl CGI before 5.00
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Perl CGI module before 5.00 is vulnerable to CPU exhaustion through inefficient regex backtracking on multipart/related Content-Type in POST requests. The unanchored pattern with .+ around boundary capture causes cubic-time backtracking on non-matching headers. No request body is needed, enabling remote unauthenticated triggering. Affects CGI versions before 5.00 for Perl.
What to do: Upgrade Perl CGI module to 5.00.
| Product | Affected | Fixed in |
|---|---|---|
| Perl CGI | before 5.00 | 5.00 |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
CGI versions before 5.00 for Perl allow CPU exhaustion via a backtracking regex on the XForms multipart/related Content-Type. When a POST Content-Type contains multipart/related, the boundary and start parameters are extracted with an unanchored pattern that puts .+ on either side of the boundary capture, which backtracks in cubic time on a header that does not match. No request body is needed.
- Weakness
- CWE-1333