Live › vulnerability › CVE-2026-118993
CallBackery for Perl builds a regular expression from the request path without escaping it, so a request with a crafted path makes the matcher backtrack exponentially. An unauthenticated remote client can keep a CGI, FastCGI or PSGI worker busy for minutes, which denies service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 13:30 UTC. All times on this page are UTC.
Teams that run a CallBackery web application under CGI, FastCGI or PSGI. The request path is controlled by the client, so any reachable deployment is exposed without credentials. Installs on versions before 0.62.0 that do not use these interfaces are not described by the sources.
No product ranges from the sources yet.
perl -MCallBackery -e 'print $CallBackery::VERSION' or in the project's cpanfile or Makefile.PLstartup() and a before_dispatch hook that strips PATH_INFO from REQUEST_URI in the application code0.62.0 are affected; move to 0.62.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI.
The before_dispatch hook installed by startup() removes PATH_INFO from the end of the request URI with a substitution that interpolates PATH_INFO unquoted. Under CGI, FastCGI and PSGI both values come from the request, so the client chooses both the pattern and the string it is matched against.
A short unauthenticated request with a backreference in the path backtracks exponentially and can keep a worker process busy for minutes.
This page as .md · .json · in your agent: get_signal("CVE-2026-118993")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.