RRD::CGI::Image before 0.01 blocks CGI via 'tz' parameter (CVE-2026-123776)
Passing a path in the 'tz' CGI query parameter blocks the Perl CGI process in versions through 0.01.
Stories per day · 30 days
2 RSS
Relatedperl2cpu-exhaustion1denial-of-service1fix-pathinfo1header-spoofing1php1php-cgi1remote-code-execution1rrd1
5 stories, newest first · one card per story
Stories tagged #cgi
CGI versions before 5.00 for Perl (20 CVEs)
20 CVEs in CGI and CGI::Cookie for Perl before 5.00 allow denial of service, CPU exhaustion and header spoofing.
PHP CGI pointer underflow allows unauthenticated RCE (CVE-2026-109618)
Default cgi.fix_pathinfo exposes PHP 5.x through 8.4.26; only the 8.2 and later branches are scheduled to be fixed.
CVE-2026-42356: Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories
Low-severity CVE-2026-42356 can execute some non-CGI files in Apache HTTP Server CGI directories.
thttpd v2.26 Stack-Based Buffer Overflow in thttpd redirect CGI Program
The redirect CGI program shipped with thttpd v2.26 has a stack buffer overflow that unauthenticated attackers can trigger for crashes or possible code execution.