Live › vulnerability › CVE-2026-120651
The Perl CGI module before 5.00 enters an infinite loop when a request's body is shorter than its declared Content-Length and the uploads-disabled setting is on. A single crafted request can keep a server process busy forever, which is a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 00:46 UTC. All times on this page are UTC.
Only servers running Perl CGI scripts that use the CGI module older than 5.00 and have $CGI::DISABLE_UPLOADS set are exposed. The flaw needs a PUTDATA_UPLOAD or upload hook setting to reach the vulnerable path, so default-configured apps that do not use these options can skip it.
No product ranges from the sources yet.
perl -MCGI -e 'print $CGI::VERSION'DISABLE_UPLOADS and PUTDATA_UPLOAD5.00 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
CGI versions before 5.00 for Perl allow an infinite loop on a short request body when $DISABLE_UPLOADS is set.
When $CGI::PUTDATA_UPLOAD or an upload hook is set, read_postdata_putdata takes a request body that is not a form submission. With $CGI::DISABLE_UPLOADS set, it discards the body by reading until Content-Length bytes have arrived. Once a body shorter than its Content-Length runs out, every read returns 0, so the loop never ends.
A client can keep a server process spinning with one such request.
This page as .md · .json · in your agent: get_signal("CVE-2026-120651")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.