UBUNTU-CVE-2026-120650: Medium severity ubuntu/libcgi-pm-perl vulnerability

Published Nov 4, 2026

Updated

CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits. $CGI::POSTMAX defaults to no limit, and when set is not enforced for chunked multipart bodies or for the boundary line of a multipart body without a boundary= parameter. Bodies saved as PUTDATA, POSTDATA or PATCHDATA uploads are read into memory in one go, and nothing limits the number of parameters or uploads.

Affected Software

7 affected components

ubuntu/libcgi-pm-perl*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade CGI for Perl to a version that resolves this vulnerability.
Fixed in 5.00

Event History

Nov 4, 2026

CVE Published

via OSV·12:17 AM

Data Sourced

via OSV·12:17 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Are default configurations affected?

Yes. $CGI::POST_MAX defaults to no limit, so installations relying on its default value do not impose a request-size limit.

Does setting $CGI::POST_MAX fully mitigate the issue?

No. The limit is not enforced for chunked multipart bodies or for the boundary line of a multipart body that lacks a boundary= parameter. It also does not limit the number of parameters or uploads.

Which request handling patterns are most relevant when triaging exposure?

CGI applications that process untrusted request bodies, multipart uploads, or large numbers of parameters are relevant. PUTDATA, POSTDATA, and PATCHDATA uploads are also significant because their bodies are read into memory in one operation.

What version boundary should be used to identify affected CGI installations?

CGI versions before 5.00 are affected. The provided data does not identify specific Ubuntu package versions containing the fixed release.

UBUNTU-CVE-2026-120650: Medium severity ubuntu/libcgi-pm-perl vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Are default configurations affected?

Does setting $CGI::POST_MAX fully mitigate the issue?

Which request handling patterns are most relevant when triaging exposure?

What version boundary should be used to identify affected CGI installations?

Company

Resources

Contact

Frequently Asked Questions

Are default configurations affected?

Does setting $CGI::POST_MAX fully mitigate the issue?

Which request handling patterns are most relevant when triaging exposure?

What version boundary should be used to identify affected CGI installations?