RRD::CGI::Image before 0.01 blocks CGI via 'tz' parameter (CVE-2026-123776)
Original title: CVE-2026-123776: RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset(), , so a FIFO or device path blocks the CGI process
Passing a path in the 'tz' CGI query parameter blocks the Perl CGI process in versions through 0.01.
RRD::CGI::Image versions through 0.01 pass CGI query parameters containing "tz" to tzset(). This allows a FIFO or device path to block the CGI process.
- Vulnerable versions: through 0.01
- Perl CGI module issue
Impact: denial of service for CGI process
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-123776 | Unvalidated TZ path in RRD::CGI::Image before 0.02 for Perl | 9.8 | — |
From the original article
Posted by Robert Rothenberg on Nov 07 ======================================================================== https://metacpan. org/dist/RRD-CGI-Image RRD::CGI::Image versions through 0. 01...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.