Log in Start free

Vulnerability · Published Nov 3, 2026 · Assigned by CPANSec

CVE-2026-120651CGI versions before 5.00 for Perl allow an infinite loop on a short request body when $DISABLE_UPLOADS is set

Unrated

In plain English

A infinite loop in CGI. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS )–Not rated
Exploit odds (30 days)0.2%top 92.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

CGI versions before 5.00 for Perl allow an infinite loop on a short request body when $DISABLE_UPLOADS is set. When $CGI::PUTDATA_UPLOAD or an upload hook is set, read_postdata_putdata takes a request body that is not a form submission. With $CGI::DISABLE_UPLOADS set, it discards the body by reading until Content-Length bytes have arrived. Once a body shorter than its Content-Length runs out, every read returns 0, so the loop never ends. A client can keep a server process spinning with one such request.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libcgi-pm-perlno fix listedDEBIAN-CVE-2026-120651
Debian:13libcgi-pm-perlno fix listedDEBIAN-CVE-2026-120651
Debian:14libcgi-pm-perlno fix listedDEBIAN-CVE-2026-120651
Ubuntu:22.04:LTSlibcgi-pm-perlno fix listedUBUNTU-CVE-2026-120651
Ubuntu:24.04:LTSlibcgi-pm-perlno fix listedUBUNTU-CVE-2026-120651
Ubuntu:26.04:LTSlibcgi-pm-perlno fix listedUBUNTU-CVE-2026-120651
Ubuntu:26.10libcgi-pm-perlno fix listedUBUNTU-CVE-2026-120651

Affected products (as reported)

VendorProductVersions
CGI 0 – before 5.00

Weakness: CWE-835

References