CGI versions before 5.00 for Perl (20 CVEs)
20 CVEs in CGI and CGI::Cookie for Perl before 5.00 allow denial of service, CPU exhaustion and header spoofing.
OSS-Security posted 20 CVEs in CGI versions before 5.00 for Perl. CVE-2026-120631 lets CGI::Cookie 4.67 before 5.00 deny service via cookie expires as regex. CVE-2026-120632 exhausts CPU via backtracking regex on XForms multipart/related Content-Type. CVE-2026-120633 lets CGI trust client X-Forwarded-Host in url, self_url, virtual_host and virtual_port.
- CVE-2026-120631 allows DoS in CGI::Cookie 4.67 before 5.00
- CVE-2026-120632 enables CPU exhaustion from regex backtracking
- CVE-2026-120633 allows X-Forwarded-Host spoofing
- 20 CVEs total listed
Impact: denial of service, CPU exhaustion and header manipulation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-120631 | DoS in Perl CGI::Cookie before 5.00 via expires regex | — | — | ||
CVE-2026-120632+1 related CVE | CPU exhaustion via backtracking regex in Perl CGI before 5.00 | — | — |
From the original article
Posted by Stig Palmquist on Nov 03 CVE-2026-120631 CGI::Cookie versions from 4. 67 before 5. 00 for Perl allow denial of service via the client cookie expires value used as a regex in parse CVE-2026-120632 CGI versions before 5.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.