CVE-2026-120645

A flaw was found in perl-cgi. When rendering option groups using the scrolling_list function, user-supplied input from request parameters is directly inserted into regular expression search patterns without proper escaping. A remote attacker can exploit this vulnerability by submitting crafted input containing invalid patterns or patterns designed to cause excessive processing. This can cause the application process to terminate or become unresponsive, resulting in a Denial of Service (DoS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.