CVE-2026-120650: CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits
CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits.
$CGI::POSTMAX defaults to no limit, and when set is not enforced for chunked multipart bodies or for the boundary line of a multipart body without a boundary= parameter. Bodies saved as PUTDATA, POSTDATA or PATCHDATA uploads are read into memory in one go, and nothing limits the number of parameters or uploads.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CGI for Perlto a version that resolves this vulnerability.Fixed in 5.00
Event History
Frequently Asked Questions
Which deployments are exposed by the default configuration?
Applications using CGI for Perl before 5.00 are exposed if they accept request bodies, because $CGI::POST_MAX defaults to no limit. Multipart handling also has no stated limit on the number of parameters or uploads.
What does an attacker need to do to trigger resource exhaustion?
An attacker needs to send requests with oversized bodies, excessive parameters or uploads, or multipart bodies that bypass configured $CGI::POST_MAX enforcement. Chunked multipart bodies and the boundary line of a multipart body lacking a boundary= parameter are specifically identified as bypass cases.
Why can PUTDATA, POSTDATA, and PATCHDATA handling be especially risky?
Bodies saved as PUTDATA, POSTDATA, or PATCHDATA uploads are read into memory in one operation. A sufficiently large request body can therefore consume memory directly, in addition to CPU and disk resources.
What version resolves the described limit-enforcement issues?
The issue affects CGI versions before 5.00 for Perl, so version 5.00 is the first version not described as affected.