CVE-2026-123776 in RRD::CGI::Image
Summary
by MITRE • 11/07/2026
RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset(), , so a FIFO or device path blocks the CGI process.
The normalize_params method sends any query key matching /tz/i to tz(), which sets $ENV{TZ} to that value, with no validation. It then calls tzset(). glibc treats a TZ value starting with / or : as a file path and opens it, so a value naming a FIFO or a blocking device stalls the process inside tzset().
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/07/2026
The vulnerability identified in RRD::CGI::Image versions through 0.01 for Perl represents a significant security flaw rooted in improper input validation within the CGI application logic. This specific issue allows remote attackers to cause a denial of service condition by exploiting how environment variables are handled during request processing. The core technical failure lies in the normalize_params method, which is responsible for sanitizing incoming data before it influences system behavior. Instead of restricting or validating parameters that affect time zone settings, this function blindly passes any query key matching the regular expression /tz/i directly to a routine that sets the TZ environment variable and subsequently invokes tzset(). This lack of validation means that arbitrary strings provided by users are accepted without scrutiny regarding their format or content.
The operational impact stems from how the GNU C Library handles time zone configuration files when invoked via tzset(). According to POSIX standards, if the TZ environment variable begins with a forward slash (/) or a colon (:), it is interpreted as an absolute file path rather than a standard time zone identifier like UTC or EST. In this vulnerable implementation, because there are no checks on the input string, an attacker can supply a value such as /dev/stdin or a named pipe (FIFO). When tzset() executes with such a value, it attempts to open and read from the specified path. If that path refers to a blocking device like stdin or a FIFO without writers, the system call will hang indefinitely waiting for input data that may never arrive. This results in the CGI process becoming permanently stalled, effectively consuming server resources and preventing legitimate requests from being processed by that specific worker thread or process.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation, as the application fails to verify that user-supplied data conforms to expected constraints before using it in system calls. Furthermore, because the attack vector involves manipulating input parameters via HTTP requests to disrupt service availability, it is closely related to CWE-770 Allocation of Resources Without Limits or Throttling and can be categorized under ATT&CK technique T1499 Endpoint Denial of Service. The exploitation does not require authentication if the CGI script is publicly accessible, making it a remote denial-of-service risk that impacts service availability rather than confidentiality or integrity directly.
Mitigation strategies for this vulnerability must focus on strict input validation and defense in depth within the Perl application code. Developers should implement allow-listing for time zone parameters, ensuring that only known valid identifiers such as those from IANA Time Zone Database are accepted. Any parameter matching /tz/i should be checked against a whitelist of safe values before being assigned to $ENV{TZ}. Alternatively, if dynamic time zones are not required, the application should ignore or sanitize these inputs entirely rather than passing them through to system functions. Additionally, implementing timeout mechanisms for CGI processes can help mitigate the impact by terminating hung requests after a reasonable duration, although this is a compensating control rather than a root cause fix. Updating to patched versions of RRD::CGI::Image that address this normalization logic is essential to resolve the issue permanently and restore service reliability.