CGI (< 5.00) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/cgi--5.00/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 04 Nov 2026 02:15:50 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPerl CGI Module: Denial of service and host header injection (CVE-2026-120631, CVE-2026-120632, CVE-2026-120633)https://feed.craftedsignal.io/briefs/2026-11-perl-cgi-vulnerabilities/Wed, 04 Nov 2026 02:15:50 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-perl-cgi-vulnerabilities/Multiple vulnerabilities in the Perl CGI module library, including versions prior to 5.00, facilitate denial-of-service and CPU exhaustion via regex backtracking and allow host header injection through untrusted X-Forwarded-Host headers.The Perl CGI module, versions prior to 5.00, contains multiple security vulnerabilities including potential denial-of-service (DoS) and host header injection. CVE-2026-120631 relates to inefficient regex parsing in CGI::Cookie (v4.67-4.99). CVE-2026-120632 involves CPU exhaustion triggered by a backtracking regex when processing XForms multipart/related Content-Type headers. CVE-2026-120633 involves improper trust of the X-Forwarded-Host header in multiple functions including url and self_url.

Impact

Applications relying on the Perl CGI module for web request handling are vulnerable to service disruption (DoS/CPU exhaustion) and potentially manipulated request routing or link generation via host header injection.

Recommendation

  • Upgrade the Perl CGI module to version 5.00 or later across all environments.
  • Review web application code for reliance on self_url, url, virtual_host, or virtual_port functions to assess potential impact from X-Forwarded-Host injection.
  • Implement upstream WAF or load balancer rules to sanitize or strip X-Forwarded-Host headers if upgrading is delayed.
  • Monitor web server CPU performance for spikes corresponding to multipart requests or cookie processing.
]]>mediumadvisoryweb-applicationdenial-of-serviceperlcgi