CVE-2026-123776 · Package
NO FIX YET
RRD::CGI::Image through version 0.01 passes any CGI query parameter whose name contains "tz" into the TZ environment variable and calls tzset() without validation. A value naming a FIFO or blocking device makes glibc open that path and stall the CGI process, which a remote requester can use to block it.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only web services that run RRD::CGI::Image as a CGI handler and expose it to requests reach this code path. The flaw is in the query parameter handling of normalize_params, so an exposed CGI endpoint is what matters. Teams that do not run this module, or run it only behind authentication, can skip it.
Not affected if auth-required, module-not-installed
Who cares cgi, perl, rrd, self-hosted
perl -MRRD::CGI::Image -e 'print $RRD::CGI::Image::VERSION'RRD::CGI::Image in CGI scripts or dependency lists that serve requests on the web.No fix yet, per the sources.
RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset(), , so a FIFO or device path blocks the CGI process.
The normalize_params method sends any query key matching /tz/i to tz(), which sets $ENV{TZ} to that value, with no validation. It then calls tzset(). glibc treats a TZ value starting with / or : as a file path and opens it, so a value naming a FIFO or a blocking device stalls the process inside tzset().
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.