DEBIAN-CVE-2026-120645: Debian/libcgi-pm-perl vulnerability
CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrollinglist. When rendering option groups, scrollinglist marks the selected options by interpolating each selected value, by default taken from the request parameters, unescaped into a substitution pattern. A client can make the request die with an invalid pattern, or tie up the process with one that backtracks heavily.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Perl CGIto a version that resolves this vulnerability.Fixed in 5.00
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using CGI's scrolling_list with option groups are exposed when selected values can come from request parameters. This is the default behavior described for selected values, so forms that render such lists may be affected without explicitly passing attacker-controlled values.
What does an attacker need to exploit it?
An attacker needs to submit values that are used as selected options when the application renders an option-group scrolling_list. Crafted values can contain an invalid regular-expression pattern or a pattern that causes excessive backtracking.
What is the impact of successful exploitation?
The request can fail because of an invalid pattern, or the process can be tied up by regex backtracking. Both outcomes are denial-of-service conditions.
What can be done if an update is not immediately available?
Avoid passing request-derived values as the selected values for option-group scrolling_list controls, or validate them so they cannot contain regex metacharacters before rendering. This removes the attacker control over the interpolated pattern.