RRD::CGI::Image: Denial of service via tzset() (CVE-2026-123776)
RRD::CGI::Image versions through 0.01 pass unsanitized CGI query parameters to the tzset() function, allowing an attacker to trigger a process hang via a FIFO or device path.
CVE search metadata
CVE search record: CVE-2026-123776. KEV: no. Product: RRD::CGI::Image (through 0.01). Brief: RRD::CGI::Image: Denial of service via tzset() (CVE-2026-123776). Brief link: https://feed.craftedsignal.io/briefs/2026-11-rrd-cgi-image-denial-of-service/
Triage facts
Revision 1- Applicability
- RRD::CGI::Image (through 0.01)
- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 7, 20:20 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- D3Roughly even chance
RRD::CGI::Image versions through 0.01 are vulnerable to a denial-of-service condition where the tz parameter in a CGI query is passed directly to the Perl tzset() function. By supplying a FIFO or device path as the value for this parameter, an attacker can cause the underlying CGI process to block indefinitely, impacting application availability.
Impact
An attacker can induce a denial-of-service by blocking the CGI process, which may lead to resource exhaustion if multiple requests are sent to the affected Perl-based web application.
Recommendation
- Audit web server access logs for requests to RRD::CGI::Image endpoints containing unusual 'tz' parameter values such as '/dev/' or pipe-like paths.
- Patch or upgrade the RRD::CGI::Image module if a secure version becomes available via CPAN.
- Implement request validation on the web server or application firewall level to restrict the 'tz' parameter to expected time zone format strings.
Threat Hunt
Identify CGI requests where the tz parameter value contains file paths or device identifiers
Data: Web server logs (uri-query or GET parameters)
Mitigations
Implement input validation to restrict the tz parameter to standard timezone names and reject paths
CVE-2026-123776
Gaps
- Lack of vendor-provided patch or updated version in the source notification