CVE-2026-120651 Details
Description
CGI versions before 5.00 for Perl allow an infinite loop on a short request body when $DISABLE_UPLOADS is set. When $CGI::PUTDATA_UPLOAD or an upload hook is set, read_postdata_putdata takes a request body that is not a form submission. With $CGI::DISABLE_UPLOADS set, it discards the body by reading until Content-Length bytes have arrived. Once a body shorter than its Content-Length runs out, every read returns 0, so the loop never ends. A client can keep a server process spinning with one such request.
A denial-of-service vulnerability has been identified in CGI versions prior to 5.00 for Perl. The issue arises when the $DISABLE_UPLOADS variable is set, and a short request body is sent with the $CGI::PUTDATA_UPLOAD variable or an upload hook activated. In this scenario, the 'read_postdata_putdata' function attempts to read the request body, which is not properly terminated, leading to an infinite loop. This causes the server process to consume 100% CPU, effectively freezing it. The vulnerability can be exploited by sending a crafted request that takes advantage of this flaw.
Users are advised to upgrade to CGI version 5.00 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/leejo/CGI.pm/commit/16d9f61acf8b844b7360e8d726338e3ce34dfa9f.patch | CPANSec | Source Code |
| https://github.com/leejo/CGI.pm/commit/8a78305065690461ae283fa24e5ebe4ec8a22fbc.patch | CPANSec | Source Code |
| https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm | CPANSec | Source Code |
| https://metacpan.org/release/LEEJO/CGI-5.00/changes | CPANSec | AdvisoryBundleRelease NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| CGI | < 5.00 |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | New CVE Received | CPANSec |