CVE-2026-120646
Description
A flaw was found in perl-cgi. A remote attacker can trigger a Denial of Service (DoS) by supplying a crafted request parameter processed by the uploadInfo function. Because the function fails to verify that the parameter represents an upload file handle, the invalid input causes an unhandled exception that terminates the application process.
Statement
This vulnerability is rated as Important severity rather than Moderate because an unauthenticated remote attacker can crash web service processes without requiring privileges or user interaction. In typical Red Hat Enterprise Linux deployments, Perl CGI scripts that process form submissions or file attachments via uploadInfo may encounter an unhandled fatal error when passed unexpected input. The blast radius is limited to the availability of the handling web application or worker process, but repeated requests can lead to sustained service disruption.
Mitigation
--- CME Mitigation Guidance (2026-11-04) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to ensure arguments passed to CGI::uploadInfo are confirmed filehandle references rather than raw user-supplied strings: upgrade to CGI 5.00+ (or the fixed Perl Cgi builds), which return immediately unless the argument is a reference that implements the filename method, closing crafted query parameter naming a defined global variable. Until patched, this is a concern on applications using perl-CGI 4.71 before 5.00 that pass user-supplied request parameters to uploadInfo(), so validate and filter request parameters before passing them to uploadInfo to ensure plain scalar strings naming global variables are not evaluated as symbolic references. As a compensating measure, Enforce strict type and value allowlisting on request parameters before invoking uploadInfo to ensure non-reference scalar strings are rejected. These controls limit blast radius and contain exploitation, but they do not fix the underlying symbolic reference dereference defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1315 Allowlist-Preferred Input Validation (Deny-by-Default Filtering) (medium)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | Low | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context
When input does not comply with the expected type, attackers could trigger unexpected errors, cause incorrect actions to take place, or exploit latent vulnerabilities that would not be possible if the input conformed with the expected type.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
