CVE-2026-120650
CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits
CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits.
$CGI::POST_MAX defaults to no limit, and when set is not enforced for chunked multipart bodies or for the boundary line of a multipart body without a boundary= parameter. Bodies saved as PUTDATA, POSTDATA or PATCHDATA uploads are read into memory in one go, and nothing limits the number of parameters or uploads.
Exploit likelihood
What each source reports
CVE List No score
CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits
CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits.
$CGI::POST_MAX defaults to no limit, and when set is not enforced for chunked multipart bodies or for the boundary line of a multipart body without a boundary= parameter. Bodies saved as PUTDATA, POSTDATA or PATCHDATA uploads are read into memory in one go, and nothing limits the number of parameters or uploads.
- Record
CVE-2026-120650- Weakness
- CWE-770
- Updated
- 2026-11-04
EUVDEUVD-2026-116616 No score
CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits.
$CGI::POST_MAX defaults to no limit, and when set is not enforced for chunked multipart bodies or for the boundary line of a multipart body without a boundary= parameter. Bodies saved as PUTDATA, POSTDATA or PATCHDATA uploads are read into memory in one go, and nothing limits the number of parameters or uploads.
- Record
EUVD-2026-116616- Updated
- 2026-11-04
GitHub AdvisoriesGHSA-55jf-7qg8-xpv8 No score
CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced...
CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits.
$CGI::POST_MAX defaults to no limit, and when set is not enforced for chunked multipart bodies or for the boundary line of a multipart body without a boundary= parameter. Bodies saved as PUTDATA, POSTDATA or PATCHDATA uploads are read into memory in one go, and nothing limits the number of parameters or uploads.
- Record
GHSA-55jf-7qg8-xpv8- Weakness
- CWE-770
- Updated
- 2026-11-04
NVD No score
CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits.
$CGI::POST_MAX defaults to no limit, and when set is not enforced for chunked multipart bodies or for the boundary line of a multipart body without a boundary= parameter. Bodies saved as PUTDATA, POSTDATA or PATCHDATA uploads are read into memory in one go, and nothing limits the number of parameters or uploads.
- Record
CVE-2026-120650- Weakness
- CWE-770
- Updated
- 2026-11-04
OSVAZL-112786 No score
CVE-2026-120650 affecting package perl-CGI 4.60-1
CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits.
$CGI::POST_MAX defaults to no limit, and when set is not enforced for chunked multipart bodies or for the boundary line of a multipart body without a boundary= parameter. Bodies saved as PUTDATA, POSTDATA or PATCHDATA uploads are read into memory in one go, and nothing limits the number of parameters or uploads.
- Record
AZL-112786- Updated
- 2026-11-07
OSV No score
CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits
CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits.
$CGI::POST_MAX defaults to no limit, and when set is not enforced for chunked multipart bodies or for the boundary line of a multipart body without a boundary= parameter. Bodies saved as PUTDATA, POSTDATA or PATCHDATA uploads are read into memory in one go, and nothing limits the number of parameters or uploads.
- Record
CVE-2026-120650- Weakness
- CWE-770
- Updated
- 2026-11-07
OSVDEBIAN-CVE-2026-120650 No score
CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits. $CGI::POST_MAX defaults to no limit, and when set is not enforced for chunked multipart bodies or for the boundary line of a multipart body without a boundary= parameter. Bodies saved as PUTDATA, POSTDATA or PATCHDATA uploads are read into memory in one go, and nothing limits the number of parameters or uploads.
- Record
DEBIAN-CVE-2026-120650- Updated
- 2026-11-05
OSVopenSUSE-SU-2026:12465-1 No score
perl-CGI-5.20.0-1.1 on GA media
These are all security issues fixed in the perl-CGI-5.20.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12465-1- Updated
- 2026-11-07
OSVUBUNTU-CVE-2026-120650 No score
CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits. $CGI::POST_MAX defaults to no limit, and when set is not enforced for chunked multipart bodies or for the boundary line of a multipart body without a boundary= parameter. Bodies saved as PUTDATA, POSTDATA or PATCHDATA uploads are read into memory in one go, and nothing limits the number of parameters or uploads.
- Record
UBUNTU-CVE-2026-120650- Updated
- 2026-11-05
Affected packages
| Package | Affected | Fixed |
|---|---|---|
perl-CGIAzure Linux:3 |
through 4.60-1 | None known |
libcgi-pm-perlDebian:12 |
All versions, plus listed versions 4.55-14.57-14.59-14.60-14.61-1 Show 11 moreShow less4.62-14.63-14.64-14.65-14.66-14.67-14.68-14.70-14.71-14.72-15.02-1 |
None known |
libcgi-pm-perlDebian:13 |
All versions, plus listed versions 4.68-14.70-14.71-14.72-15.02-1 |
None known |
libcgi-pm-perlDebian:14 |
All versions, plus listed versions 4.68-14.70-14.71-14.72-15.02-1 |
None known |
libcgi-pm-perlUbuntu:16.04:LTS |
All versions, plus listed versions 4.21-14.22-14.25-14.26-1 |
None known |
libcgi-pm-perlUbuntu:18.04:LTS |
All versions, plus listed versions 4.36-14.37-14.38-1 |
None known |
libcgi-pm-perlUbuntu:20.04:LTS |
All versions, plus listed versions 4.44-14.45-14.46-1 |
None known |
libcgi-pm-perlUbuntu:22.04:LTS |
All versions, plus listed versions 4.51-14.53-14.54-1 |
None known |
libcgi-pm-perlUbuntu:24.04:LTS |
All versions, plus listed versions 4.57-14.60-14.61-14.62-14.63-1 |
None known |
libcgi-pm-perlUbuntu:26.10 |
All versions, plus listed versions 4.71-1build14.72-1 |
None known |
libcgi-pm-perlUbuntu:26.04:LTS |
All versions, plus listed versions 4.68-14.71-14.71-1build1 |
None known |
perl-CGIopenSUSE:Tumbleweed From an advisory covering 20 CVEs |
before 5.20.0-1.1 | 5.20.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected, aliases, references | OSV | |
| affected, aliases, references | NVD, OSV | |
| references | OSV | |
| affected, aliases, references | OSV | |
| aliases | EUVD, NVD | |
| first indexed | CVE List, GitHub Advisories |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-120650 is a vulnerability with no CVSS score yet in perl-CGI, published November 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 8th percentile. No source names a fixed version.
References
metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm
github.com/leejo/CGI.pm/commit/17b838dc14d2b82ae6c7e76f66ec2c3f3b08038b.patch
Show 33 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-120650
cpan.org/modules
security-tracker.debian.org/tracker/CVE-2026-120650
ubuntu.com/security/CVE-2026-120650
cve.org/CVERecord?id=CVE-2026-120650
lists.security.metacpan.org/cve-announce/msg/44875016
suse.com/security/cve/CVE-2026-120631