CVE-2026-19873
nicheUnauthenticated DoS in Perl HTML::FormFu via unbounded Repeatable repeat count
HTML::FormFu through 2.08 for Perl is vulnerable to unauthenticated denial of service: when a Repeatable element sets counter_name, the repeat count is read directly from a named query-string parameter, validated only as a positive integer, and never capped. Any plain GET request reaches the deep-clone loop with no credentials, session, or request body, and nested Repeatables multiply the work (outer and inner counts of 100 build 10,000 clones), while post-submission constraint scanning adds super-linear cost. A single crafted request can exhaust memory and CPU and take the application down. Any Perl web application using HTML::FormFu with Repeatable elements and counter_name is affected; note that no fixed release exists — CPAN's latest is 2.07 (2018) and the git-only 2.08 is also affected. Exploitation status: no public PoC, not in CISA KEV, EPSS roughly 0.5%, and no known exploitation in the wild.
What to do: Inventory Perl applications for HTML::FormFu use, specifically Repeatable elements with counter_name set, and whether such forms are reachable via unauthenticated GETs. Since no fixed version exists yet (CPAN 2.07 and git-only 2.08 are both affected), cap or sanitize the counter_name query parameter at the application or reverse-proxy layer (reject values above a small bound) to prevent the unbounded clone loop. Monitor the HTML::FormFu git repository and CPAN for a patched release and upgrade when one is published.
| HTML::FormFu project (CPAN) HTML::FormFu | all versions through 2.08 (CPAN latest is 2.07; 2.08 exists only in the git repository; no fixed release available) |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements. When a Repeatable element has counter_name set, its process method reads the repeat count from the named query string parameter, checks only that it is a positive integer, and passes it to repeat, which deep-clones the element's child subtree once per iteration. Nothing caps the value, and no attribute lets an application impose a limit. The count is read on every request, before the form decides whether it was submitted, so a plain GET reaches the clone loop with no credentials, no session and no request body. Nesting multiplies: a Repeatable inside a Repeatable takes a counter at each level, so an outer and an inner value of 100 build 10,000 clones. Once the form is submitted, each cloned field's constraints scan the whole element tree in _find_field_value, so cost grows faster than linearly with the count. A single request exhausts memory and CPU. The latest release on CPAN is 2.07, from 2018. Version 2.08 exists only in the git repository.
- Weakness
- CWE-770, CWE-1284
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
In the news0 stories
No ingested article mentions this CVE yet.