CVE-2026-120650
perl-cgi: perl-cgi: Denial of Service via unenforced request and upload limits
Severity
ImportantRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · November 4, 2026
Updated · November 4, 2026
Description
A flaw was found in perl-cgi. A remote attacker can trigger a Denial of Service (DoS) through excessive memory, processor, and disk space consumption by sending specially crafted HTTP requests. Due to missing or unenforced limits on request sizes, parameters, and file uploads, the module processes oversized or chunked payloads directly into memory without restriction, leading to system resource exhaustion.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 · Allocation of Resources Without Limits or Throttling