CVE-2026-120645: CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrolling_list

Q: What request path is exposed to this denial of service?

The issue is reachable when an application uses CGI.pm's scrolling_list with option groups and selected values come from request parameters, which is the default behavior described. Those values are interpolated into the pattern used to mark selected options during rendering.

Q: What does an attacker need to send?

An attacker needs to submit a selected value containing regular-expression syntax. An invalid pattern can cause the request to die, while a pattern designed for heavy backtracking can tie up the process.

Q: Are default application settings affected?

They can be. The selected values used by scrolling_list are taken from request parameters by default, so applications that use option-group rendering without overriding that behavior may expose the vulnerable path.

Q: Which versions require remediation?

CGI versions before 5.00 are affected. Upgrading to CGI 5.00 or later addresses the described behavior.

Published Nov 3, 2026

Updated

CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrollinglist.

When rendering option groups, scrollinglist marks the selected options by interpolating each selected value, by default taken from the request parameters, unescaped into a substitution pattern.

A client can make the request die with an invalid pattern, or tie up the process with one that backtracks heavily.

Affected Software

4 affected components

debian/libcgi-pm-perl*

debian/libcgi-pm-perl<=4.55-1, <=4.68-1, <=4.72-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade CGI for Perl to a version that resolves this vulnerability.
Fixed in 5.00

Event History

Nov 3, 2026

CVE Published

via MITRE·11:40 PM

Data Sourced

via MITRE·11:40 PM

RemedyDescriptionWeakness

Data Sourced

via OSV·11:40 PM

DescriptionWeakness

Nov 4, 2026

Data Sourced

via NVD·12:17 AM

DescriptionWeakness

Data Sourced

via OSV·12:17 AM

Affected Software

Frequently Asked Questions

What request path is exposed to this denial of service?

The issue is reachable when an application uses CGI.pm's scrolling_list with option groups and selected values come from request parameters, which is the default behavior described. Those values are interpolated into the pattern used to mark selected options during rendering.

What does an attacker need to send?

An attacker needs to submit a selected value containing regular-expression syntax. An invalid pattern can cause the request to die, while a pattern designed for heavy backtracking can tie up the process.

Are default application settings affected?

They can be. The selected values used by scrolling_list are taken from request parameters by default, so applications that use option-group rendering without overriding that behavior may expose the vulnerable path.

Which versions require remediation?

CGI versions before 5.00 are affected. Upgrading to CGI 5.00 or later addresses the described behavior.

CVE-2026-120645: CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrolling_list

Affected Software

Remediation

Event History

Frequently Asked Questions

What request path is exposed to this denial of service?

What does an attacker need to send?

Are default application settings affected?

Which versions require remediation?

Company

Resources

Contact

Frequently Asked Questions

What request path is exposed to this denial of service?

What does an attacker need to send?

Are default application settings affected?

Which versions require remediation?