DEBIAN-CVE-2026-120632: Debian/libcgi-pm-perl vulnerability
CGI versions before 5.00 for Perl allow CPU exhaustion via a backtracking regex on the XForms multipart/related Content-Type. When a POST Content-Type contains multipart/related, the boundary and start parameters are extracted with an unanchored pattern that puts .+ on either side of the boundary capture, which backtracks in cubic time on a header that does not match. No request body is needed.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to send to trigger the CPU exhaustion?
An attacker needs to submit a POST request with a Content-Type header using multipart/related that is crafted not to match the boundary/start parameter extraction pattern. No request body is required.
Which deployments are realistically exposed?
Deployments using CGI versions earlier than 5.00 for Perl are exposed when they process attacker-controlled POST Content-Type headers. The issue is in handling multipart/related Content-Type values.
How severe can the resource impact be?
The affected regex can backtrack in cubic time as the malformed header grows, allowing a single request header to consume excessive CPU. Because no body is needed, request-size controls that apply only to bodies do not prevent this condition.