{"id":"CVE-2026-120646","kind":"vulnerability","aliases":["CVE-2026-120646"],"related":[],"title":"Perl CGI: plain string input crashes uploadInfo, denying service","description":"CGI versions from 4.71 before 5.00 for Perl allow denial of service via a plain string dereferenced as a symbolic reference in uploadInfo.\n\nuploadInfo dereferences its argument and calls its filename method without checking that it is an upload filehandle. A plain string naming a defined global variable, such as the parameter value from ?upload=0, is treated as a symbolic reference, and the method call on it dies.","summary":"The Perl CGI module from 4.71 before 5.00 calls a method on a string the caller controls when it should check for an upload filehandle. A crafted request parameter makes the call die, which stops the script handling that request.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cgi","package","perl","self-hosted"],"not_affected_if":["cgi-5.00-or-later","no-upload-handling"],"how_to_check":"- `perl -MCGI -e 'print $CGI::VERSION'` to read the installed CGI module version\n- Search application code and dependency lockfiles for `CGI` and call sites of `uploadInfo`","fix":"- Move to CGI `5.00` or later (per the sources; the fixed version is stated in the patch linked from the NVD entry)","status":"open","published_at":"2026-11-04T00:17:26+00:00","first_seen_at":"2026-11-04T00:46:17+00:00","triaged_at":"2026-11-04T00:48:09+00:00","updated_at":"2026-11-04T00:48:09+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T00:48:09Z","model":"claude-haiku-5-5","output":{"fix":"- Move to CGI `5.00` or later (per the sources; the fixed version is stated in the patch linked from the NVD entry)","reach":"internet","title":"Perl CGI: plain string input crashes uploadInfo, denying service","impact":"low","summary":"The Perl CGI module from 4.71 before 5.00 calls a method on a string the caller controls when it should check for an upload filehandle. A crafted request parameter makes the call die, which stops the script handling that request.","audience":"developers","category":"package","nicknames":[],"who_cares":["perl","cgi","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"request handling process dies, causing denial of service","analyst_note":"","how_to_check":"- `perl -MCGI -e 'print $CGI::VERSION'` to read the installed CGI module version\n- Search application code and dependency lockfiles for `CGI` and call sites of `uploadInfo`","plain_action":"","needs_analyst":false,"not_affected_if":["cgi-5.00-or-later","no-upload-handling"],"who_is_affected":"Applications that run the Perl CGI module from 4.71 before 5.00 and call uploadInfo on request parameters, which is the upload path in CGI.pm. Scripts that never read uploads through CGI, or that run a newer CGI release, can skip it. The sources do not say whether default configurations are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000682,"input_tokens":4171,"output_tokens":529,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-120646':12A,15A '-2026':11A,14A '0':117C '4.71':27B,65C '5.00':29B,67C 'allow':70C 'argument':88C 'call':30B,53B,90C,127C 'caller':37B 'cgi':2A,16B,24B,62C 'check':42B,95C 'control':38B 'craft':48B 'crash':6A 'cve':10A,13A 'defin':107C 'deni':8A 'denial':71C 'derefer':86C 'dereferenc':78C 'die':54B,130C 'filehandl':46B,101C 'filenam':92C 'global':108C 'handl':59B 'host':21B 'input':5A 'make':51B 'method':32B,93C,126C 'modul':25B 'name':105C 'packag':17B 'paramet':50B,113C 'perl':1A,18B,23B,69C 'plain':3A,76C,103C 'refer':82C,123C 'request':49B,61B 'script':58B 'self':20B 'self-host':19B 'servic':9A,73C 'stop':56B 'string':4A,35B,77C,104C 'symbol':81C,122C 'treat':119C 'upload':45B,100C,116C 'uploadinfo':7A,84C,85C 'valu':114C 'variabl':109C 'version':63C 'via':74C 'without':94C","nicknames":[],"mitigations":[],"who_affected":"Applications that run the Perl CGI module from 4.71 before 5.00 and call uploadInfo on request parameters, which is the upload path in CGI.pm. Scripts that never read uploads through CGI, or that run a newer CGI release, can skip it. The sources do not say whether default configurations are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cgi","low","package","perl","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-04T00:17:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120646","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120646","severity":null,"published_at":"2026-11-04T00:17:26+00:00","modified_at":"2026-11-04T00:17:26+00:00","first_seen_at":"2026-11-04T00:46:17+00:00","fetched_at":"2026-11-04T00:46:17+00:00","note":null}],"documents":[{"id":62126,"url":"https://github.com/leejo/CGI.pm/commit/a14a7decfdc18f2daf436d30df9b543e3f0f8da3.patch","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}