CVE-2026-120645 in CGI
Summary
by MITRE • 11/04/2026
CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrolling_list.
When rendering option groups, scrolling_list marks the selected options by interpolating each selected value, by default taken from the request parameters, unescaped into a substitution pattern.
A client can make the request die with an invalid pattern, or tie up the process with one that backtracks heavily.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/04/2026
The Common Gateway Interface (CGI) module for Perl, specifically versions prior to 5.00, contains a critical vulnerability in its scrolling_list function that enables denial of service attacks through maliciously crafted input parameters. This component is designed to render HTML select elements with optgroup tags, facilitating user selection from grouped options within web forms. The core technical flaw lies in how the module handles selected values during this rendering process. When generating the output for option groups, scrolling_list identifies which options are pre-selected by interpolating each selected value directly into a regular expression substitution pattern without proper escaping or sanitization. This behavior assumes that input data is benign and well-formed, failing to account for adversarial inputs designed to exploit regex engine weaknesses.
This implementation detail creates two distinct vectors for denial of service attacks against applications relying on this module. First, an attacker can submit values containing characters with special meaning in regular expressions but which do not form valid patterns when interpolated into the specific context used by scrolling_list. This results in a runtime error that causes the Perl process to die abruptly, leading to immediate service disruption for any user attempting to access or interact with the affected page. Second, and potentially more dangerous due to its stealthier nature, an attacker can submit values crafted to trigger catastrophic backtracking within the regex engine. By carefully constructing input strings that cause exponential time complexity in pattern matching, the attacker can consume excessive CPU resources, effectively freezing the server process for a prolonged period without necessarily causing it to crash immediately.
The operational impact of this vulnerability is significant for any web application using CGI.pm versions before 5.00 and utilizing scrolling_list with user-controlled input for selected values. Since request parameters are commonly derived from HTTP GET or POST data, an external attacker can easily trigger these conditions by manipulating form submissions or URL query strings. The resulting denial of service affects availability, a core pillar of the CIA triad in information security. In high-traffic environments, such vulnerabilities can be exploited to degrade performance for all users, not just the one submitting the malicious payload, especially if the server relies on single-threaded processing models where each request blocks others until completion or failure.
Mitigation strategies primarily involve upgrading the CGI module to version 5.00 or later, where this interpolation behavior has been corrected to prevent unescaped input from being treated as regex patterns. For applications unable to upgrade immediately due to legacy constraints, developers should implement strict input validation and sanitization on all parameters passed to scrolling_list before they are used in rendering logic. This includes ensuring that selected values do not contain regular expression metacharacters or limiting the complexity of allowed characters. Additionally, implementing resource limits such as timeout mechanisms for Perl processes can help mitigate the impact of catastrophic backtracking attacks by terminating hung requests after a reasonable duration.
From an industry standards perspective, this vulnerability aligns with CWE-400, which describes uncontrolled resource consumption leading to denial of service conditions. The mechanism of exploiting regex complexity also relates to CWE-1325, specifically involving incorrect regular expression matching that allows for catastrophic backtracking. In terms of the MITRE ATT&CK framework, this exploitation technique falls under T1499, Endpoint Denial of Service, as it aims to exhaust computational resources on a specific target system. Security teams should prioritize patching affected systems and review codebases for similar patterns where user input is interpolated into dynamic regular expressions without adequate sanitization, ensuring robust defense-in-depth against resource exhaustion attacks.