Live › vulnerability › CVE-2026-120650
The Perl CGI module before 5.00 does not enforce its POST_MAX size limit for chunked multipart bodies or multipart bodies without a boundary parameter, and it reads PUTDATA, POSTDATA and PATCHDATA uploads into memory at once. An attacker can send large or many-parameter requests to exhaust server memory, CPU and disk.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 00:46 UTC. All times on this page are UTC.
Applications that use the Perl CGI module to parse incoming form or multipart requests are exposed, especially web endpoints reachable from the internet. Setting a request size limit does not fully protect older versions because the limit is not enforced for some multipart forms. Systems that do not use the CGI module, or that accept requests only from trusted internal clients, can skip this.
No product ranges from the sources yet.
perl -MCGI -e 'print $CGI::VERSION'$CGI::POST_MAX is set in your application code or configurationgrep -r "use CGI" .5.00 or later (per the advisory's affected range, versions before 5.00)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits.
$CGI::POST_MAX defaults to no limit, and when set is not enforced for chunked multipart bodies or for the boundary line of a multipart body without a boundary= parameter. Bodies saved as PUTDATA, POSTDATA or PATCHDATA uploads are read into memory in one go, and nothing limits the number of parameters or uploads.
This page as .md · .json · in your agent: get_signal("CVE-2026-120650")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.