DEBIAN-CVE-2026-120650: Debian/libcgi-pm-perl vulnerability
CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits. $CGI::POSTMAX defaults to no limit, and when set is not enforced for chunked multipart bodies or for the boundary line of a multipart body without a boundary= parameter. Bodies saved as PUTDATA, POSTDATA or PATCHDATA uploads are read into memory in one go, and nothing limits the number of parameters or uploads.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CGIto a version that resolves this vulnerability.Fixed in 5.00
Event History
Frequently Asked Questions
Which deployments are exposed by default?
CGI versions before 5.00 are exposed where they process attacker-controlled requests. In particular, $CGI::POST_MAX defaults to no limit, so applications that have not configured request-size controls can accept unbounded request bodies.
What does an attacker need to do to trigger the issue?
An attacker needs to send requests to an application that uses the affected CGI handling. Resource exhaustion can be triggered with oversized request bodies, excessive parameters or uploads, and multipart requests that use chunked bodies or omit the boundary= parameter.
Why might setting $CGI::POST_MAX not be sufficient?
The configured limit is not enforced for chunked multipart bodies or for the boundary line of a multipart body that lacks a boundary= parameter. Data saved as PUTDATA, POSTDATA, or PATCHDATA uploads is also read into memory in one operation.
What mitigations are available if upgrading is delayed?
Enforce request-body, multipart upload, parameter-count, and upload-count limits before requests reach CGI. Apply limits at the web server, reverse proxy, or another front-end layer, including limits for chunked requests and multipart parsing.
How can an administrator identify potentially affected application behavior?
Review applications using CGI versions before 5.00 and identify endpoints that accept POST, PUT, or PATCH bodies, multipart forms, parameters, or uploads. Configurations relying only on $CGI::POST_MAX should be treated as insufficient for the multipart cases described.