RRD::CGI::Image (Through 0.01) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/rrdcgiimage-through-0.01/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 07 Nov 2026 20:20:47 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgRRD::CGI::Image: Denial of service via tzset() (CVE-2026-123776)https://feed.craftedsignal.io/briefs/2026-11-rrd-cgi-image-denial-of-service/Sat, 07 Nov 2026 20:20:47 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-rrd-cgi-image-denial-of-service/RRD::CGI::Image versions through 0.01 pass unsanitized CGI query parameters to the tzset() function, allowing an attacker to trigger a process hang via a FIFO or device path.RRD::CGI::Image versions through 0.01 are vulnerable to a denial-of-service condition where the tz parameter in a CGI query is passed directly to the Perl tzset() function. By supplying a FIFO or device path as the value for this parameter, an attacker can cause the underlying CGI process to block indefinitely, impacting application availability.

Impact

An attacker can induce a denial-of-service by blocking the CGI process, which may lead to resource exhaustion if multiple requests are sent to the affected Perl-based web application.

Recommendation

  • Audit web server access logs for requests to RRD::CGI::Image endpoints containing unusual 'tz' parameter values such as '/dev/' or pipe-like paths.
  • Patch or upgrade the RRD::CGI::Image module if a secure version becomes available via CPAN.
  • Implement request validation on the web server or application firewall level to restrict the 'tz' parameter to expected time zone format strings.
]]>mediumadvisory