{"id":"CVE-2026-120631","kind":"vulnerability","aliases":["CVE-2026-120631"],"related":[],"title":"Perl CGI::Cookie: crafted cookie expires value causes denial of service","description":"CGI::Cookie versions from 4.67 before 5.00 for Perl allow denial of service via the client cookie expires value used as a regex in parse.\n\nCGI's cookie method reads the Cookie request header through parse, which interpolates the header's expires value unescaped into the substitution pattern that removes it from the cookie string.\n\nA client can make the request die with an invalid pattern, or tie up the process with one that backtracks catastrophically.","summary":"CGI::Cookie from 4.67 before 5.00 for Perl uses the client's cookie expires value unescaped as a regular expression when parsing the Cookie header. A remote client can crash the request with an invalid pattern or tie up the process with catastrophic backtracking, causing denial of service.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cgi","package","perl","web-apps"],"not_affected_if":["not-using-cgi-cookie","versions-before-4.67-or-5.00-plus"],"how_to_check":"- Check the installed CGI module version with `perl -MCGI -e 'print $CGI::VERSION'`\n- Look for CGI::Cookie in application dependencies, for example `cpanm --info CGI` or your cpanfile.lock\n- Check whether the application calls CGI's cookie method on request headers","fix":"- CGI::Cookie `5.00` or later (the fix is in versions 5.00 and above, per the sources' version range)\n- Patch link referenced in sources: github.com","status":"open","published_at":"2026-11-04T00:17:24+00:00","first_seen_at":"2026-11-04T00:46:16+00:00","triaged_at":"2026-11-04T00:48:28+00:00","updated_at":"2026-11-04T00:48:28+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T00:48:28Z","model":"claude-haiku-5-5","output":{"fix":"- CGI::Cookie `5.00` or later (the fix is in versions 5.00 and above, per the sources' version range)\n- Patch link referenced in sources: github.com","reach":"internet","title":"Perl CGI::Cookie: crafted cookie expires value causes denial of service","impact":"low","summary":"CGI::Cookie from 4.67 before 5.00 for Perl uses the client's cookie expires value unescaped as a regular expression when parsing the Cookie header. A remote client can crash the request with an invalid pattern or tie up the process with catastrophic backtracking, causing denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["perl","cgi","web-apps"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Process crashes or hangs, causing denial of service","analyst_note":"","how_to_check":"- Check the installed CGI module version with `perl -MCGI -e 'print $CGI::VERSION'`\n- Look for CGI::Cookie in application dependencies, for example `cpanm --info CGI` or your cpanfile.lock\n- Check whether the application calls CGI's cookie method on request headers","plain_action":"","needs_analyst":false,"not_affected_if":["not-using-cgi-cookie","versions-before-4.67-or-5.00-plus"],"who_is_affected":"Applications written in Perl that use CGI::Cookie (or its cookie method) to read incoming Cookie headers from clients are exposed when running versions from 4.67 up to but not including 5.00. Web apps that do not use CGI's cookie parsing, or that run a different CGI implementation, can skip it. Public-facing CGI scripts are the most exposed because any client can send the header.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000741,"input_tokens":4175,"output_tokens":647,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-120631':14A,17A '-2026':13A,16A '4.67':27B,76C '5.00':29B,78C 'allow':81C 'app':23B 'backtrack':67B,146C 'catastroph':66B,147C 'caus':8A,68B 'cgi':2A,18B,24B,72C,97C 'client':34B,51B,87C,128C 'cooki':3A,5A,25B,36B,47B,73C,88C,99C,103C,125C 'craft':4A 'crash':53B 'cve':12A,15A 'denial':9A,69B,82C 'die':133C 'expir':6A,37B,89C,113C 'express':43B 'header':48B,105C,111C 'interpol':109C 'invalid':58B,136C 'make':130C 'method':100C 'one':144C 'packag':19B 'pars':45B,96C,107C 'pattern':59B,119C,137C 'perl':1A,20B,31B,80C 'process':64B,142C 'read':101C 'regex':94C 'regular':42B 'remot':50B 'remov':121C 'request':55B,104C,132C 'servic':11A,71B,84C 'string':126C 'substitut':118C 'tie':61B,139C 'unescap':39B,115C 'use':32B,91C 'valu':7A,38B,90C,114C 'version':74C 'via':85C 'web':22B 'web-app':21B","nicknames":[],"mitigations":[],"who_affected":"Applications written in Perl that use CGI::Cookie (or its cookie method) to read incoming Cookie headers from clients are exposed when running versions from 4.67 up to but not including 5.00. Web apps that do not use CGI's cookie parsing, or that run a different CGI implementation, can skip it. Public-facing CGI scripts are the most exposed because any client can send the header.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cgi","package","perl","unknown","webapps"],"campaign_type":null,"first_public_at":"2026-11-04T00:17:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120631","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120631","severity":null,"published_at":"2026-11-04T00:17:24+00:00","modified_at":"2026-11-04T00:17:24+00:00","first_seen_at":"2026-11-04T00:46:16+00:00","fetched_at":"2026-11-04T00:46:16+00:00","note":null}],"documents":[{"id":62107,"url":"https://github.com/leejo/CGI.pm/commit/95e044af2ec24d99a61e99d6291580ad47aff641.patch","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}