CVE-2026-120650 — Vulnerability intelligence
—
Published:
- CVSS
- Not available
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits.
$CGI::POST_MAX defaults to no limit, and when set is not enforced for chunked multipart bodies or for the boundary line of a multipart body without a boundary= parameter. Bodies saved as PUTDATA, POSTDATA or PATCHDATA uploads are read into memory in one go, and nothing limits the number of parameters or uploads.