Cyber ·
CVE-2026-123776: RRD::CGI::Image up to version 0.01 can block CGI process via tz parameter
CPAN Security Group advisory on the Perl module RRD::CGI::Image, up to version 0.01: CGI parameters containing tz can make tzset() block the process when the path used is a FIFO or device.
On 7 November 2026, Robert Rothenberg posted advisory CVE-2026-123776 to the oss-sec mailing list feed, assigned by the CPAN Security Group. It affects the RRD-CGI-Image distribution, versions up to 0.01. According to the available text, CGI parameters containing the tz field can cause the tzset() function to block the process when a FIFO or device path is used. The result is a halted CGI process, an availability problem. The content received is an automatic translation and the excerpt is truncated, so it does not state a fix, a fixed version, or full exploitation conditions. To confirm these points, consult the original advisory on the oss-sec list and the module page on MetaCPAN, referenced in the text itself. Relevance: Perl CGI applications that use this module and accept user-supplied time zone values may hang. Rota Nacional does not patch third-party Perl libraries, and this advisory does not involve personal data. If you study the topic with AI assistance, do not paste logs or credentials.