CVE-2026-120651
Description
A flaw was found in perl-cgi. A remote attacker can trigger a denial of service (DoS) by sending an HTTP request containing a body shorter than its declared Content-Length header. When file upload processing is disabled, the server enters an infinite loop attempting to discard remaining data, consuming excessive CPU resources and rendering the affected server process unresponsive.
Statement
Red Hat rates this flaw as Moderate severity because an unauthenticated remote attacker can exhaust server CPU resources by inducing an endless loop in web worker processes, though exploitation requires specific non-default configuration options and cannot compromise data confidentiality or integrity. In typical Red Hat Enterprise Linux environments, Perl CGI is primarily maintained for legacy web services, and this behavior is only triggered when applications explicitly configure upload restrictions alongside custom upload handlers or raw input processing. Because the condition is confined to the execution context of the impacted CGI process and does not grant unauthorized access or privilege escalation, the overall operational risk remains bounded.
Mitigation
--- CME Mitigation Guidance (2026-11-04) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to terminate read loops in CGI.pm read_postdata_putdata when zero-byte reads are returned during truncated request body discarding: upgrade to CGI 5.00 (or the fixed Perl Cgi builds), which terminate read loops with an error if consecutive zero-length reads exceed $CGI::MultipartBuffer::SPIN_LOOP_MAX, closing all 3 injection vectors (truncated HTTP POST body with oversized Content-Length, truncated HTTP PUT body with oversized Content-Length, truncated HTTP PATCH body with oversized Content-Length). Until patched, this is a concern on Perl CGI applications with $DISABLE_UPLOADS enabled and $PUTDATA_UPLOAD enabled or an upload hook configured, so avoid combining $DISABLE_UPLOADS with $PUTDATA_UPLOAD or upload hooks in Internet-facing Perl CGI application configurations. As a compensating measure, impose RLIMIT_CPU process limits on Perl CGI processes using ulimit or prlimit to terminate processes caught in the CPU-spinning loop and configure service watchdog monitoring and automatic restart directives such as systemd WatchdogSec and Restart to recover hung worker processes. These controls limit blast radius and contain exploitation, but they do not fix the underlying infinite loop defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-114 Process Resource Limits (ulimit/prlimit) (medium)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | Low | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Amplification
An infinite loop will cause unexpected consumption of resources, such as CPU cycles or memory. The software's operation may slow down, or cause a long time to respond.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
