---
id: "CVE-2026-120631"
kind: "vulnerability"
aliases: ["CVE-2026-120631"]
title: "Perl CGI::Cookie: crafted cookie expires value causes denial of service"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cgi", "package", "perl", "web-apps"]
not_affected_if: ["not-using-cgi-cookie", "versions-before-4.67-or-5.00-plus"]
published_at: "2026-11-04T00:17:24+00:00"
first_seen_at: "2026-11-04T00:46:16+00:00"
updated_at: "2026-11-04T00:48:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120631", "first_seen_at": "2026-11-04T00:46:16+00:00"}]
---

# Perl CGI::Cookie: crafted cookie expires value causes denial of service

CGI::Cookie from 4.67 before 5.00 for Perl uses the client's cookie expires value unescaped as a regular expression when parsing the Cookie header. A remote client can crash the request with an invalid pattern or tie up the process with catastrophic backtracking, causing denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed CGI module version with `perl -MCGI -e 'print $CGI::VERSION'`
- Look for CGI::Cookie in application dependencies, for example `cpanm --info CGI` or your cpanfile.lock
- Check whether the application calls CGI's cookie method on request headers

## Fix

- CGI::Cookie `5.00` or later (the fix is in versions 5.00 and above, per the sources' version range)
- Patch link referenced in sources: github.com

## Timeline

- 2026-11-04T00:46:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120631

## Documents

- [fix] Patch: github.com https://github.com/leejo/CGI.pm/commit/95e044af2ec24d99a61e99d6291580ad47aff641.patch

## From the sources

CGI::Cookie versions from 4.67 before 5.00 for Perl allow denial of service via the client cookie expires value used as a regex in parse.

CGI's cookie method reads the Cookie request header through parse, which interpolates the header's expires value unescaped into the substitution pattern that removes it from the cookie string.

A client can make the request die with an invalid pattern, or tie up the process with one that backtracks catastrophically.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_