{"id":"CVE-2026-120650","kind":"vulnerability","aliases":["CVE-2026-120650"],"related":[],"title":"Perl CGI: missing request size limits let attackers exhaust memory and disk","description":"CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits.\n\n$CGI::POST_MAX defaults to no limit, and when set is not enforced for chunked multipart bodies or for the boundary line of a multipart body without a boundary= parameter. Bodies saved as PUTDATA, POSTDATA or PATCHDATA uploads are read into memory in one go, and nothing limits the number of parameters or uploads.","summary":"The Perl CGI module before 5.00 does not enforce its POST_MAX size limit for chunked multipart bodies or multipart bodies without a boundary parameter, and it reads PUTDATA, POSTDATA and PATCHDATA uploads into memory at once. An attacker can send large or many-parameter requests to exhaust server memory, CPU and disk.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cgi","package","perl","self-hosted"],"not_affected_if":["auth-required","internal-only","no-cgi-module"],"how_to_check":"- Check the installed CGI module version with `perl -MCGI -e 'print $CGI::VERSION'`\n- Check whether `$CGI::POST_MAX` is set in your application code or configuration\n- Find applications that use the CGI module with `grep -r \"use CGI\" .`","fix":"- Perl CGI: upgrade to `5.00` or later (per the advisory's affected range, versions before 5.00)","status":"open","published_at":"2026-11-04T00:17:26+00:00","first_seen_at":"2026-11-04T00:46:17+00:00","triaged_at":"2026-11-04T00:48:07+00:00","updated_at":"2026-11-04T00:48:07+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T00:48:07Z","model":"claude-haiku-5-5","output":{"fix":"- Perl CGI: upgrade to `5.00` or later (per the advisory's affected range, versions before 5.00)","reach":"internet","title":"Perl CGI: missing request size limits let attackers exhaust memory and disk","impact":"medium","summary":"The Perl CGI module before 5.00 does not enforce its POST_MAX size limit for chunked multipart bodies or multipart bodies without a boundary parameter, and it reads PUTDATA, POSTDATA and PATCHDATA uploads into memory at once. An attacker can send large or many-parameter requests to exhaust server memory, CPU and disk.","audience":"developers","category":"package","nicknames":[],"who_cares":["perl","cgi","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Server memory, CPU and disk get exhausted, causing denial of service.","analyst_note":"Confirm the fixed version and the exact affected range from the NVD entry and the linked patch commits; the sources here do not state the fixed version explicitly.","how_to_check":"- Check the installed CGI module version with `perl -MCGI -e 'print $CGI::VERSION'`\n- Check whether `$CGI::POST_MAX` is set in your application code or configuration\n- Find applications that use the CGI module with `grep -r \"use CGI\" .`","plain_action":"","needs_analyst":true,"not_affected_if":["no-cgi-module","auth-required","internal-only"],"who_is_affected":"Applications that use the Perl CGI module to parse incoming form or multipart requests are exposed, especially web endpoints reachable from the internet. Setting a request size limit does not fully protect older versions because the limit is not enforced for some multipart forms. Systems that do not use the CGI module, or that accept requests only from trusted internal clients, can skip this.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000763,"input_tokens":4241,"output_tokens":678,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-120650':15A,18A '-2026':14A,17A '5.00':30B,82C 'allow':85C 'attack':8A,63B 'bodi':42B,45B,117C,126C,131C 'boundari':48B,121C,129C 'cgi':2A,19B,27B,79C,101C 'chunk':40B,115C 'cpu':76B,87C 'cve':13A,16A 'default':104C 'disk':12A,78B,89C 'enforc':33B,113C 'exhaust':9A,73B,90C 'go':145C 'host':24B 'larg':66B 'let':7A 'limit':6A,38B,100C,107C,148C 'line':122C 'mani':69B 'many-paramet':68B 'max':36B,103C 'memori':10A,59B,75B,86C,142C 'miss':3A,92C 'modul':28B 'multipart':41B,44B,116C,125C 'noth':147C 'number':150C 'one':144C 'packag':20B 'paramet':49B,70B,97C,130C,152C 'patchdata':56B,137C 'perl':1A,21B,26B,84C 'post':35B,102C 'postdata':54B,135C 'putdata':53B,134C 'read':52B,140C 'request':4A,71B,95C 'save':132C 'self':23B 'self-host':22B 'send':65B 'server':74B 'set':110C 'size':5A,37B,96C 'unenforc':94C 'upload':57B,99C,138C,154C 'version':80C 'via':91C 'without':46B,127C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the Perl CGI module to parse incoming form or multipart requests are exposed, especially web endpoints reachable from the internet. Setting a request size limit does not fully protect older versions because the limit is not enforced for some multipart forms. Systems that do not use the CGI module, or that accept requests only from trusted internal clients, can skip this.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cgi","medium","package","perl","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-04T00:17:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120650","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120650","severity":null,"published_at":"2026-11-04T00:17:26+00:00","modified_at":"2026-11-04T00:17:26+00:00","first_seen_at":"2026-11-04T00:46:17+00:00","fetched_at":"2026-11-04T00:46:17+00:00","note":null}],"documents":[{"id":62129,"url":"https://github.com/leejo/CGI.pm/commit/17b838dc14d2b82ae6c7e76f66ec2c3f3b08038b.patch","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":62130,"url":"https://github.com/leejo/CGI.pm/commit/277baeb74fde7bce975a7bd0a1f98dcf1b9b2050.patch","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":62131,"url":"https://github.com/leejo/CGI.pm/commit/8940a74e53a41563f72813b45f99cceaaa4c92e8.patch","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":62132,"url":"https://github.com/leejo/CGI.pm/commit/f3febefe63fe3881d8c3ae10fa83ca8ec950b959.patch","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}