CVE-2026-120631
Description
A flaw was found in perl-cgi. A remote attacker can cause a Denial of Service (DoS) by sending an HTTP request with a specially crafted Cookie header containing a malformed expiration attribute. Because the cookie parser inserts this unescaped value directly into an internal regular expression (a pattern-matching rule), the input can cause the application to crash or become unresponsive due to excessive processing time.
Statement
This vulnerability is rated as Important because an unauthenticated remote attacker can cause a denial of service across the network without requiring credentials or user interaction. Web applications and services that parse incoming client cookies using perl-CGI are directly susceptible to process termination or resource starvation when exposed to untrusted traffic. Deployments that do not expose CGI scripts to untrusted networks or do not process cookie headers are not exposed to remote exploitation.
Mitigation
--- CME Mitigation Guidance (2026-11-04) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to eliminate unescaped regular expression interpolation by parsing cookie expiration attributes with string offset operations instead of regex substitution patterns in CGI::Cookie: upgrade to CGI 5.00+ (or the fixed Perl Cgi builds), which remove the matched expires substring using string offsets with substr instead of interpolating the value into a regex pattern, closing all 2 injection vectors (HTTP Cookie header with invalid regex metacharacters, HTTP Cookie header with pathological backtracking regex constructs). Until patched, this is a concern on applications using CGI::Cookie->parse or CGI->cookie to parse incoming HTTP request cookies, so restrict network access to applications processing HTTP cookies with CGI::Cookie or sanitize incoming Cookie headers at reverse proxies and web application firewalls to block metacharacters in expires attributes. These controls limit blast radius and contain exploitation, but they do not fix the underlying unescaped regex interpolation defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1316 Algorithmic Complexity Safeguards (Pattern/Regex Execution Limits) (high)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU)
Attackers can create crafted inputs that intentionally cause the regular expression to use excessive backtracking in a way that causes the CPU consumption to spike.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
