Resource exhaustion in CGI for Perl via unlimited request sizes
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- —
- Fix status
- Partial Red Hat: 4 without a fix
No CVSS vector from any source. Fix status from CNA and Red Hat. Impact type from CWE-770.
Summary
CGI for Perl versions before 5.00 allow memory, CPU and disk exhaustion because request size, parameter and upload limits are missing or not enforced. $CGI::POST_MAX is unlimited by default and is not enforced for chunked multipart bodies, and PUTDATA, POSTDATA and PATCHDATA bodies are read into memory at once. This is tracked as CWE-770, allocation of resources without limits or throttling.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
Description from the CNA
CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits. $CGI::POST_MAX defaults to no limit, and when set is not enforced for chunked multipart bodies or for the boundary line of a multipart body without a boundary= parameter. Bodies saved as PUTDATA, POSTDATA or PATCHDATA uploads are read into memory in one go, and nothing limits the number of parameters or uploads.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | CGI | before 5.00 | 5.00 | Patch available | CNA |
- CGI Vendor— Affected before 5.00 Fixed in 5.00 Patch available CNA
Remediation
Upgrade CGI for Perl to version 5.00 or later. Red Hat lists Red Hat Enterprise Linux 7, 8, 9 and 10 as affected with no available fix plan.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
- Fix · CNA CGI Fixed in 5.00
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 10 | Affected | No fix yet |
| Red Hat Enterprise Linux 7 | Affected | No fix yet |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
Timeline
- 2026-11-03 Threatist record created from CVE-2026-120650
- 2026-11-04 Affected versions changed · Red Hat
- 2026-11-04 CVSS score added · Red Hat
- 2026-11-04 Alias added: GHSA-55jf-7qg8-xpv8
References
Patch 4
- https://github.com/leejo/CGI.pm/commit/17b838dc14d2b82ae6c7e76f66ec2c3f3b08038b.patch
- https://github.com/leejo/CGI.pm/commit/f3febefe63fe3881d8c3ae10fa83ca8ec950b959.patch
- https://github.com/leejo/CGI.pm/commit/277baeb74fde7bce975a7bd0a1f98dcf1b9b2050.patch
- https://github.com/leejo/CGI.pm/commit/8940a74e53a41563f72813b45f99cceaaa4c92e8.patch
Sources
- CVE-2026-120650 · CVE Program
- CVE-2026-120650 · NVD
- FIRST EPSS
- GHSA-55jf-7qg8-xpv8 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-120650 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences