CVE-2026-120650
Description
A flaw was found in perl-cgi. A remote attacker can trigger a Denial of Service (DoS) through excessive memory, processor, and disk space consumption by sending specially crafted HTTP requests. Due to missing or unenforced limits on request sizes, parameters, and file uploads, the module processes oversized or chunked payloads directly into memory without restriction, leading to system resource exhaustion.
Statement
This vulnerability is rated as an Important severity because it allows unauthenticated remote attackers to cause complete service unavailability without requiring privileges or user interaction. In Red Hat Enterprise Linux environments hosting Perl-based web applications, scripts parsing inbound HTTP traffic with this module fail to enforce proper boundaries on parameters and multipart payloads. Consequently, untrusted network traffic can rapidly deplete memory, storage, and processing capacity on production systems.
Mitigation
--- CME Mitigation Guidance (2026-11-04) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce strict upper bounds on incoming request body sizes, parameter counts, boundary lengths, and file uploads within the web server or proxy layer before reaching CGI scripts: upgrade to CGI 5.00 (or the fixed Perl Cgi builds), which enforce a default 128MB POST_MAX dynamically during reads, process postdata in bounded chunks, cap initial boundary lines at 1KB, and reject requests exceeding 10,000 parameters or 1,000 uploads with HTTP 413, closing all 5 injection vectors (monolithic in-memory slurping of large POST, PUT, or PATCH request bodies, unbounded multipart boundary line read lacking a boundary parameter, chunked multipart payloads bypassing static CONTENT_LENGTH checks, excessive parameter counts in URL queries or form bodies, excessive multipart file uploads exhausting file descriptors and disk space). Until patched, this is a concern on applications accepting HTTP POST, PUT, PATCH, or multipart requests using perl-CGI prior to version 5.00, so restrict maximum allowed HTTP body sizes, parameter quantities, and file upload counts at upstream reverse proxies or web servers, and reject requests lacking a boundary parameter on multipart content types. As a compensating measure, monitor cgroup memory pressure via memory.events and PSI to detect anomalous memory surges and imminent out-of-memory conditions, constrain process address space and maximum file sizes using ulimit or prlimit to contain denial of service, and enforce hard cgroups v2 memory and CPU resource bounds on the Perl application process to limit blast radius. These controls limit blast radius and contain exploitation, but they do not fix the underlying unenforced request and upload limits defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
