Cyber ·
Vulnerabilities in CGI for Perl versions before 5.00 (20 CVEs)
A security advisory posted on the oss-sec list collects 20 CVEs in CGI for Perl before version 5.00, with denial-of-service and CPU exhaustion risks. The text cites CGI::Cookie from 4.67 onward and trust in the X-Forwarded-Host header.
The advisory, published on November 3, 2026 by Stig Palmquist on the oss-sec list, describes 20 vulnerabilities (CVEs) in the CGI module for Perl before version 5.00. The issues include denial of service and CPU exhaustion. Examples listed are: CVE-2026-120631, where CGI::Cookie versions from 4.67 onward and before 5.00 allow denial of service through the client's cookie expiration value, used as a regular expression during parsing; CVE-2026-120632, where a backtracking regular expression in processing of XForms multipart/related Content-Type causes CPU exhaustion; and CVE-2026-120633, where the module trusts the client's X-Forwarded-Host header in the url, self_url, virtual_host and virtual_port functions. The source text is truncated at these points and does not detail the full list of 20 identifiers.
To consult and verify, use the original message on the oss-sec list, linked from the feed, and compare the CVE identifiers with the official CVE database and with the advisory from the Perl project or the distribution you use. Confirm the installed CGI version with your Perl module tooling before making any decision. Rota Nacional does not patch web server libraries or solve these engineering problems; the recommendation is to update the module, independently of the platform.
Original source: Versões do CGI para Perl anteriores à 5.00 (20 CVEs)