CVE-2026-120632

CVSS 6.5 (medium) · published 2026-11-04

CGI versions before 5.00 for Perl allow CPU exhaustion via a backtracking regex on the XForms multipart/related Content-Type. When a POST Content-Type contains multipart/related, the boundary and start parameters are extracted with an unanchored pattern that puts .+ on either side of the boundary capture, which backtracks in cubic time on a header that does not match. No request body is needed.

Weakness: CWE-1333

Source: NVD CVE-2026-120632

References

• https://github.com/leejo/CGI.pm/commit/1e529c7ac8d410a51b4b04ab9d6cc00d51ef33c0.patch
• https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm
• https://metacpan.org/release/LEEJO/CGI-5.00/changes

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.