CVE-2026-118993: CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI

Published Oct 30, 2026

Updated

CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI.

The beforedispatch hook installed by startup() removes PATHINFO from the end of the request URI with a substitution that interpolates PATHINFO unquoted. Under CGI, FastCGI and PSGI both values come from the request, so the client chooses both the pattern and the string it is matched against.

A short unauthenticated request with a backreference in the path backtracks exponentially and can keep a worker process busy for minutes.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade CallBackery to a version that resolves this vulnerability.
Fixed in 0.62.0

Event History

Oct 30, 2026

CVE Published

via MITRE·01:11 PM

Data Sourced

via MITRE·01:11 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·01:18 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to this denial-of-service condition?

CallBackery deployments using versions before 0.62.0 are exposed when run under CGI, FastCGI, or PSGI. In those environments, both PATH_INFO and the request URI used by the vulnerable substitution are client-controlled.

Does an attacker need authentication or a long request to trigger the issue?

No. A client can send a short unauthenticated request containing a backreference in the path, causing exponential regular-expression backtracking and potentially occupying a worker process for minutes.

How can I determine whether my application is affected?

Check whether it uses CallBackery before version 0.62.0 and calls startup(), which installs the affected before_dispatch hook. Confirm whether the application is deployed through CGI, FastCGI, or PSGI.

CVE-2026-118993: CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this denial-of-service condition?

Does an attacker need authentication or a long request to trigger the issue?

How can I determine whether my application is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this denial-of-service condition?

Does an attacker need authentication or a long request to trigger the issue?

How can I determine whether my application is affected?