CVE-2026-120646: CGI versions from 4.71 before 5.00 for Perl allow denial of service via a plain string dereferenced as a symbolic reference in uploadInfo

Q: Which deployments are affected?

Deployments using the Perl CGI module from version 4.71 up to, but not including, 5.00 are affected if their application passes attacker-controlled input to uploadInfo.

Q: What does an attacker need to trigger the denial of service?

An attacker needs to supply a plain string that names a defined global variable as the argument processed by uploadInfo. The example given is an upload parameter value of 0 via ?upload=0.

Q: What is the impact of a successful trigger?

uploadInfo treats the string as a symbolic reference and calls filename on it rather than verifying it is an upload filehandle. That method call dies, causing denial of service.

Q: How can exposure be reduced before upgrading?

Ensure uploadInfo is called only with validated upload filehandles, not directly with request parameter strings or other attacker-controlled values.

Published Nov 3, 2026

Updated

CGI versions from 4.71 before 5.00 for Perl allow denial of service via a plain string dereferenced as a symbolic reference in uploadInfo.

uploadInfo dereferences its argument and calls its filename method without checking that it is an upload filehandle. A plain string naming a defined global variable, such as the parameter value from ?upload=0, is treated as a symbolic reference, and the method call on it dies.

Affected Software

4 affected components

debian/libcgi-pm-perl*

debian/libcgi-pm-perl<=4.55-1, <=4.68-1, <=4.72-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade CGI for Perl to a version that resolves this vulnerability.
Fixed in 5.00

Event History

Nov 3, 2026

CVE Published

via MITRE·11:40 PM

Data Sourced

via MITRE·11:40 PM

RemedyDescriptionWeakness

Data Sourced

via OSV·11:40 PM

DescriptionWeakness

Nov 4, 2026

Data Sourced

via NVD·12:17 AM

DescriptionWeakness

Data Sourced

via OSV·12:17 AM

Affected Software

Frequently Asked Questions

Which deployments are affected?

Deployments using the Perl CGI module from version 4.71 up to, but not including, 5.00 are affected if their application passes attacker-controlled input to uploadInfo.

What does an attacker need to trigger the denial of service?

An attacker needs to supply a plain string that names a defined global variable as the argument processed by uploadInfo. The example given is an upload parameter value of 0 via ?upload=0.

What is the impact of a successful trigger?

uploadInfo treats the string as a symbolic reference and calls filename on it rather than verifying it is an upload filehandle. That method call dies, causing denial of service.

How can exposure be reduced before upgrading?

Ensure uploadInfo is called only with validated upload filehandles, not directly with request parameter strings or other attacker-controlled values.

CVE-2026-120646: CGI versions from 4.71 before 5.00 for Perl allow denial of service via a plain string dereferenced as a symbolic reference in uploadInfo

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to trigger the denial of service?

What is the impact of a successful trigger?

How can exposure be reduced before upgrading?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to trigger the denial of service?

What is the impact of a successful trigger?

How can exposure be reduced before upgrading?