Live › vulnerability › CVE-2026-120631
CGI::Cookie from 4.67 before 5.00 for Perl uses the client's cookie expires value unescaped as a regular expression when parsing the Cookie header. A remote client can crash the request with an invalid pattern or tie up the process with catastrophic backtracking, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 00:46 UTC. All times on this page are UTC.
Applications written in Perl that use CGI::Cookie (or its cookie method) to read incoming Cookie headers from clients are exposed when running versions from 4.67 up to but not including 5.00. Web apps that do not use CGI's cookie parsing, or that run a different CGI implementation, can skip it. Public-facing CGI scripts are the most exposed because any client can send the header.
No product ranges from the sources yet.
perl -MCGI -e 'print $CGI::VERSION'cpanm --info CGI or your cpanfile.lock5.00 or later (the fix is in versions 5.00 and above, per the sources' version range)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CGI::Cookie versions from 4.67 before 5.00 for Perl allow denial of service via the client cookie expires value used as a regex in parse.
CGI's cookie method reads the Cookie request header through parse, which interpolates the header's expires value unescaped into the substitution pattern that removes it from the cookie string.
A client can make the request die with an invalid pattern, or tie up the process with one that backtracks catastrophically.
This page as .md · .json · in your agent: get_signal("CVE-2026-120631")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.