CVE-2026-120650
Unknown
Description
CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits. $CGI::POST_MAX defaults to no limit, and when set is not enforced for chunked multipart bodies or for the boundary line of a multipart body without a boundary= parameter. Bodies saved as PUTDATA, POSTDATA or PATCHDATA uploads are read into memory in one go, and nothing limits the number of parameters or uploads.
SeverityUnknown
CVSS—
Exploit probability8. percentile0.2%
ProductCgi
PublishedNov 4, 2026
First seenNov 4, 2026
Weakness typeCWE-770Allocation of resources without limits
How to fix
Update
- CGI5.00 or later
Patches
- github.com/leejo/CGI.pm/commit/17b838dc14d2b82ae6c7e76f66ec2c3f3b08038b.patch
- github.com/leejo/CGI.pm/commit/f3febefe63fe3881d8c3ae10fa83ca8ec950b959.patch
- github.com/leejo/CGI.pm/commit/277baeb74fde7bce975a7bd0a1f98dcf1b9b2050.patch
- github.com/leejo/CGI.pm/commit/8940a74e53a41563f72813b45f99cceaaa4c92e8.patch
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| CGI | v < 5.00 | 5.00 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.