Live › vulnerability › CVE-2026-120632
The Perl CGI module before 5.00 parses the multipart/related Content-Type header with a regular expression that backtracks heavily on non-matching input. A single crafted POST header can tie up CPU, causing a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 00:46 UTC. All times on this page are UTC.
Perl applications that load the CGI module and accept POST requests are exposed, since the flaw triggers from the Content-Type header alone with no request body. Applications that do not use CGI, or that run behind a proxy that rejects malformed Content-Type headers, are less exposed. The sources do not say which specific CGI features are needed to reach the regex.
No product ranges from the sources yet.
perl -MCGI -e 'print $CGI::VERSION'CGI in cpanfile, Makefile.PL or other Perl dependency files and confirm the pinned version5.00 and later (per the advisory; patch linked in sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CGI versions before 5.00 for Perl allow CPU exhaustion via a backtracking regex on the XForms multipart/related Content-Type.
When a POST Content-Type contains multipart/related, the boundary and start parameters are extracted with an unanchored pattern that puts .+ on either side of the boundary capture, which backtracks in cubic time on a header that does not match. No request body is needed.
This page as .md · .json · in your agent: get_signal("CVE-2026-120632")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.