CVE-2026-120632: CGI versions before 5.00 for Perl allow CPU exhaustion via a backtracking regex on the XForms multipart/related Content-Type

Q: What does an attacker need to send to trigger the issue?

An attacker needs to send a POST request with a Content-Type header containing multipart/related and crafted boundary and start parameters that fail to match the parser's expected pattern. No request body is required.

Q: Which deployments are affected?

Deployments using Perl CGI versions before 5.00 are affected. CGI 5.00 is the version identified by the provided data as the fixed release.

Q: How can I assess whether a system is exposed?

Check the installed version of the Perl CGI module. Versions earlier than 5.00 should be considered exposed if they process attacker-controlled POST Content-Type headers.

Published Nov 3, 2026

Updated

CGI versions before 5.00 for Perl allow CPU exhaustion via a backtracking regex on the XForms multipart/related Content-Type.

When a POST Content-Type contains multipart/related, the boundary and start parameters are extracted with an unanchored pattern that puts .+ on either side of the boundary capture, which backtracks in cubic time on a header that does not match. No request body is needed.

Affected Software

4 affected components

debian/libcgi-pm-perl*

debian/libcgi-pm-perl<=4.55-1, <=4.68-1, <=4.72-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Perl CGI to a version that resolves this vulnerability.
Fixed in 5.00

Event History

Nov 3, 2026

CVE Published

via MITRE·11:40 PM

Data Sourced

via MITRE·11:40 PM

RemedyDescriptionWeakness

Nov 4, 2026

Data Sourced

via NVD·12:17 AM

DescriptionWeakness

Data Sourced

via OSV·12:17 AM

DescriptionAffected Software

Frequently Asked Questions

What does an attacker need to send to trigger the issue?

An attacker needs to send a POST request with a Content-Type header containing multipart/related and crafted boundary and start parameters that fail to match the parser's expected pattern. No request body is required.

Which deployments are affected?

Deployments using Perl CGI versions before 5.00 are affected. CGI 5.00 is the version identified by the provided data as the fixed release.

How can I assess whether a system is exposed?

Check the installed version of the Perl CGI module. Versions earlier than 5.00 should be considered exposed if they process attacker-controlled POST Content-Type headers.

CVE-2026-120632: CGI versions before 5.00 for Perl allow CPU exhaustion via a backtracking regex on the XForms multipart/related Content-Type

Affected Software

Remediation

Event History

Frequently Asked Questions

What does an attacker need to send to trigger the issue?

Which deployments are affected?

How can I assess whether a system is exposed?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to send to trigger the issue?

Which deployments are affected?

How can I assess whether a system is exposed?