---
id: "CVE-2026-123776"
page: "https://infrastack.ai/live/CVE-2026-123776"
kind: "vulnerability"
aliases: ["CVE-2026-123776"]
title: "Perl RRD::CGI::Image: CGI query parameter can hang the process"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cgi", "package", "perl", "rrd", "self-hosted"]
not_affected_if: ["auth-required", "module-not-installed"]
published_at: "2026-11-07T12:17:46+00:00"
first_seen_at: "2026-11-07T12:47:09+00:00"
updated_at: "2026-11-07T12:49:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123776", "first_seen_at": "2026-11-07T12:47:09+00:00"}]
exploit_sources: []
---

# Perl RRD::CGI::Image: CGI query parameter can hang the process

Link for people: https://infrastack.ai/live/CVE-2026-123776 (this .md is for agents)

RRD::CGI::Image through version 0.01 passes any CGI query parameter whose name contains "tz" into the TZ environment variable and calls tzset() without validation. A value naming a FIFO or blocking device makes glibc open that path and stall the CGI process, which a remote requester can use to block it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the Perl module is installed: `perl -MRRD::CGI::Image -e 'print $RRD::CGI::Image::VERSION'`
- Look for `RRD::CGI::Image` in CGI scripts or dependency lists that serve requests on the web.

## Timeline

- 2026-11-07T12:47:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123776

## From the sources

RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset(), , so a FIFO or device path blocks the CGI process.

The normalize_params method sends any query key matching /tz/i to tz(), which sets $ENV{TZ} to that value, with no validation. It then calls tzset(). glibc treats a TZ value starting with / or : as a file path and opens it, so a value naming a FIFO or a blocking device stalls the process inside tzset().

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_