{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/rrdcgiimage-through-0.01/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-123776"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["RRD::CGI::Image (through 0.01)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eRRD::CGI::Image versions through 0.01 are vulnerable to a denial-of-service condition where the tz parameter in a CGI query is passed directly to the Perl tzset() function. By supplying a FIFO or device path as the value for this parameter, an attacker can cause the underlying CGI process to block indefinitely, impacting application availability.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAn attacker can induce a denial-of-service by blocking the CGI process, which may lead to resource exhaustion if multiple requests are sent to the affected Perl-based web application.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAudit web server access logs for requests to RRD::CGI::Image endpoints containing unusual 'tz' parameter values such as '/dev/' or pipe-like paths.\u003c/li\u003e\n\u003cli\u003ePatch or upgrade the RRD::CGI::Image module if a secure version becomes available via CPAN.\u003c/li\u003e\n\u003cli\u003eImplement request validation on the web server or application firewall level to restrict the 'tz' parameter to expected time zone format strings.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T20:20:47Z","date_published":"2026-11-07T20:20:47Z","id":"https://feed.craftedsignal.io/briefs/2026-11-rrd-cgi-image-denial-of-service/","summary":"RRD::CGI::Image versions through 0.01 pass unsanitized CGI query parameters to the tzset() function, allowing an attacker to trigger a process hang via a FIFO or device path.","title":"RRD::CGI::Image: Denial of service via tzset() (CVE-2026-123776)","url":"https://feed.craftedsignal.io/briefs/2026-11-rrd-cgi-image-denial-of-service/"}],"language":"en","title":"CraftedSignal Threat Feed - RRD::CGI::Image (Through 0.01)","version":"https://jsonfeed.org/version/1.1"}