DEBIAN-CVE-2026-120651: Debian/libcgi-pm-perl vulnerability
CGI versions before 5.00 for Perl allow an infinite loop on a short request body when $DISABLEUPLOADS is set. When $CGI::PUTDATAUPLOAD or an upload hook is set, readpostdataputdata takes a request body that is not a form submission. With $CGI::DISABLEUPLOADS set, it discards the body by reading until Content-Length bytes have arrived. Once a body shorter than its Content-Length runs out, every read returns 0, so the loop never ends. A client can keep a server process spinning with one such request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CGI for Perlto a version that resolves this vulnerability.Fixed in 5.00
Event History
Frequently Asked Questions
Which deployments are exposed?
Exposure requires CGI versions before 5.00 with $CGI::DISABLE_UPLOADS set and either $CGI::PUTDATA_UPLOAD or an upload hook configured. The affected request path handles bodies that are not form submissions.
What does an attacker need to send?
An attacker can send a request whose body ends before the number of bytes declared in Content-Length. This can cause a server process to continue spinning on that single request.
How can I identify potentially affected applications?
Check whether the installed CGI version is earlier than 5.00, then review application configuration and code for $CGI::DISABLE_UPLOADS together with $CGI::PUTDATA_UPLOAD or an upload hook. Applications without those conditions are not described as reaching the affected path.