Live › vulnerability › CVE-2026-120645
The Perl CGI module before 5.00 interpolates submitted request values unescaped into a regular expression when rendering option groups in scrolling_list. A remote client can send a value that makes the request die on an invalid pattern or consume the process with heavy backtracking, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 00:46 UTC. All times on this page are UTC.
Applications written in Perl that use the CGI module's scrolling_list method with values taken from user requests are exposed. Code that does not call scrolling_list, or that only passes fixed server-side values, is not affected by this description. unknown for the exact default-configuration scope.
No product ranges from the sources yet.
perl -MCGI -e 'print $CGI::VERSION'scrolling_list that pass request parameters as selected values5.00 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrolling_list.
When rendering option groups, scrolling_list marks the selected options by interpolating each selected value, by default taken from the request parameters, unescaped into a substitution pattern.
A client can make the request die with an invalid pattern, or tie up the process with one that backtracks heavily.
This page as .md · .json · in your agent: get_signal("CVE-2026-120645")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.