AZL-112789: CVE-2026-120651 affecting package perl-CGI 4.60-1

Q: Which deployments are exposed to this denial-of-service condition?

Deployments using CGI before 5.00 are exposed when CGI::DISABLE_UPLOADS is set and either CGI::PUTDATA_UPLOAD or an upload hook is configured. The vulnerable path is reached for request bodies that are not form submissions.

Q: What must an attacker send to trigger the infinite loop?

An attacker must send a request with a Content-Length larger than the actual request body, so the body ends before the declared number of bytes arrives. After the short body is exhausted, reads return 0 and the affected server process can continue spinning.

Q: Are default configurations affected?

The issue requires CGI::DISABLE_UPLOADS to be set, along with CGI::PUTDATA_UPLOAD or an upload hook. The provided information does not state whether those settings are enabled by default.

Q: What can be done if an update cannot be applied immediately?

Avoid the affected configuration by not setting CGI::DISABLE_UPLOADS in combination with CGI::PUTDATA_UPLOAD or an upload hook. Where feasible, reject requests whose body terminates before the declared Content-Length.

Published Nov 4, 2026

Updated

CGI versions before 5.00 for Perl allow an infinite loop on a short request body when $DISABLEUPLOADS is set.

When $CGI::PUTDATAUPLOAD or an upload hook is set, readpostdataputdata takes a request body that is not a form submission. With $CGI::DISABLEUPLOADS set, it discards the body by reading until Content-Length bytes have arrived. Once a body shorter than its Content-Length runs out, every read returns 0, so the loop never ends.

A client can keep a server process spinning with one such request.

Affected Software

1 affected component

azure-linux/perl-cgi<=4.60-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade perl-CGI to a version that resolves this vulnerability.
Fixed in 5.00

Event History

Nov 4, 2026

Advisory Published

via OSV·12:17 AM

Data Sourced

via OSV·12:17 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-120651

Frequently Asked Questions

Which deployments are exposed to this denial-of-service condition?

Deployments using CGI before 5.00 are exposed when CGI::DISABLE_UPLOADS is set and either CGI::PUTDATA_UPLOAD or an upload hook is configured. The vulnerable path is reached for request bodies that are not form submissions.

What must an attacker send to trigger the infinite loop?

An attacker must send a request with a Content-Length larger than the actual request body, so the body ends before the declared number of bytes arrives. After the short body is exhausted, reads return 0 and the affected server process can continue spinning.

Are default configurations affected?

The issue requires CGI::DISABLE_UPLOADS to be set, along with CGI::PUTDATA_UPLOAD or an upload hook. The provided information does not state whether those settings are enabled by default.

What can be done if an update cannot be applied immediately?

Avoid the affected configuration by not setting CGI::DISABLE_UPLOADS in combination with CGI::PUTDATA_UPLOAD or an upload hook. Where feasible, reject requests whose body terminates before the declared Content-Length.

AZL-112789: CVE-2026-120651 affecting package perl-CGI 4.60-1

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are exposed to this denial-of-service condition?

What must an attacker send to trigger the infinite loop?

Are default configurations affected?

What can be done if an update cannot be applied immediately?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this denial-of-service condition?

What must an attacker send to trigger the infinite loop?

Are default configurations affected?

What can be done if an update cannot be applied immediately?