{"id":"CVE-2026-118993","kind":"vulnerability","aliases":["CVE-2026-118993"],"related":[],"title":"CallBackery Perl: crafted request path can stall a worker for minutes","description":"CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI.\n\nThe before_dispatch hook installed by startup() removes PATH_INFO from the end of the request URI with a substitution that interpolates PATH_INFO unquoted. Under CGI, FastCGI and PSGI both values come from the request, so the client chooses both the pattern and the string it is matched against.\n\nA short unauthenticated request with a backreference in the path backtracks exponentially and can keep a worker process busy for minutes.","summary":"CallBackery for Perl builds a regular expression from the request path without escaping it, so a request with a crafted path makes the matcher backtrack exponentially. An unauthenticated remote client can keep a CGI, FastCGI or PSGI worker busy for minutes, which denies service.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["callbackery","cgi","fastcgi","package","perl","psgi"],"not_affected_if":["no-cgi-fastcgi-psgi","version-0.62.0-or-later"],"how_to_check":"- Check the installed CallBackery version with `perl -MCallBackery -e 'print $CallBackery::VERSION'` or in the project's cpanfile or Makefile.PL\n- Look for `startup()` and a `before_dispatch` hook that strips PATH_INFO from REQUEST_URI in the application code","fix":"- CallBackery versions before `0.62.0` are affected; move to `0.62.0` or later","status":"open","published_at":"2026-10-30T13:18:32+00:00","first_seen_at":"2026-10-30T13:30:27+00:00","triaged_at":"2026-10-30T13:32:24+00:00","updated_at":"2026-10-30T13:32:24+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T13:32:24Z","model":"claude-haiku-5-5","output":{"fix":"- CallBackery versions before `0.62.0` are affected; move to `0.62.0` or later","reach":"internet","title":"CallBackery Perl: crafted request path can stall a worker for minutes","impact":"low","summary":"CallBackery for Perl builds a regular expression from the request path without escaping it, so a request with a crafted path makes the matcher backtrack exponentially. An unauthenticated remote client can keep a CGI, FastCGI or PSGI worker busy for minutes, which denies service.","audience":"developers","category":"package","nicknames":[],"who_cares":["perl","callbackery","cgi","fastcgi","psgi"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Worker process stalls for minutes, causing denial of service","analyst_note":"","how_to_check":"- Check the installed CallBackery version with `perl -MCallBackery -e 'print $CallBackery::VERSION'` or in the project's cpanfile or Makefile.PL\n- Look for `startup()` and a `before_dispatch` hook that strips PATH_INFO from REQUEST_URI in the application code","plain_action":"","needs_analyst":false,"not_affected_if":["version-0.62.0-or-later","no-cgi-fastcgi-psgi"],"who_is_affected":"Teams that run a CallBackery web application under CGI, FastCGI or PSGI. The request path is controlled by the client, so any reachable deployment is exposed without credentials. Installs on versions before 0.62.0 that do not use these interfaces are not described by the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000715,"input_tokens":4212,"output_tokens":587,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118993':14A,17A '-2026':13A,16A '0.62.0':71C 'allow':74C 'backrefer':148C 'backtrack':48B,152C 'build':27B 'busi':62B,160C 'callbackeri':1A,18B,24B,68C 'cgi':19B,57B,88C,118C 'choos':131C 'client':53B,130C 'come':124C 'craft':3A,43B 'cve':12A,15A 'deni':66B 'denial':75C 'dispatch':94C 'end':104C 'escap':36B 'exponenti':49B,153C 'express':30B,86C 'fastcgi':20B,58B,89C,119C 'hook':95C 'info':101C,115C 'instal':96C 'interpol':82C,113C 'keep':55B,156C 'make':45B 'match':140C 'matcher':47B 'minut':11A,64B,162C 'packag':21B 'path':5A,34B,44B,81C,100C,114C,151C 'pattern':134C 'perl':2A,22B,26B,73C 'process':159C 'psgi':23B,60B,91C,121C 'regular':29B,85C 'remot':52B 'remov':99C 'request':4A,33B,40B,80C,107C,127C,145C 'servic':67B,77C 'short':143C 'stall':7A 'startup':98C 'string':137C 'substitut':111C 'unauthent':51B,144C 'unquot':116C 'uri':108C 'valu':123C 'version':69C 'via':78C 'without':35B 'worker':9A,61B,158C","nicknames":[],"mitigations":[],"who_affected":"Teams that run a CallBackery web application under CGI, FastCGI or PSGI. The request path is controlled by the client, so any reachable deployment is exposed without credentials. Installs on versions before 0.62.0 that do not use these interfaces are not described by the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T13:18:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118993","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118993","severity":null,"published_at":"2026-10-30T13:18:32+00:00","modified_at":"2026-10-30T13:18:32+00:00","first_seen_at":"2026-10-30T13:30:27+00:00","fetched_at":"2026-10-30T13:30:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}