Vulnerability · Published Oct 30, 2026 · Assigned by CPANSec
CVE-2026-118993CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI
Unrated
In plain English
A regular-expression denial of service in CallBackery. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).
Official description
CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI. The before_dispatch hook installed by startup() removes PATH_INFO from the end of the request URI with a substitution that interpolates PATH_INFO unquoted. Under CGI, FastCGI and PSGI both values come from the request, so the client chooses both the pattern and the string it is matched against. A short unauthenticated request with a backreference in the path backtracks exponentially and can keep a worker process busy for minutes.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CallBackery | 0 – before 0.62.0 |
Weakness: CWE-1333