DEBIAN-CVE-2026-120631: Debian/libcgi-pm-perl vulnerability
CGI::Cookie versions from 4.67 before 5.00 for Perl allow denial of service via the client cookie expires value used as a regex in parse. CGI's cookie method reads the Cookie request header through parse, which interpolates the header's expires value unescaped into the substitution pattern that removes it from the cookie string. A client can make the request die with an invalid pattern, or tie up the process with one that backtracks catastrophically.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CGI::Cookieto a version that resolves this vulnerability.Fixed in 5.00
Event History
Frequently Asked Questions
Who can trigger the denial of service?
Any client able to send an HTTP request with a crafted Cookie header to an application that invokes CGI::Cookie parsing can trigger it. The crafted expires value can cause an invalid regular-expression pattern or catastrophic backtracking.
What component needs to be examined when assessing exposure?
Examine applications using the CGI::Cookie module, particularly code that calls CGI's cookie method and therefore parses the Cookie request header. The affected package identified here is debian/libcgi-pm-perl.
How can I tell whether a service may be affected?
A service may be affected if it uses CGI::Cookie in a version from 4.67 before 5.00 and processes client-supplied Cookie headers through parse. Requests with malformed or specially crafted expires values may produce pattern-related failures or unusually long processing times.