CVE-2026-19873 in HTML::FormFu
Summary
by MITRE • 08/31/2026
HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements.
When a Repeatable element has counter_name set, its process method reads the repeat count from the named query string parameter, checks only that it is a positive integer, and passes it to repeat, which deep-clones the element's child subtree once per iteration. Nothing caps the value, and no attribute lets an application impose a limit.
The count is read on every request, before the form decides whether it was submitted, so a plain GET reaches the clone loop with no credentials, no session and no request body. Nesting multiplies: a Repeatable inside a Repeatable takes a counter at each level, so an outer and an inner value of 100 build 10,000 clones.
Once the form is submitted, each cloned field's constraints scan the whole element tree in _find_field_value, so cost grows faster than linearly with the count. A single request exhausts memory and CPU.
The latest release on CPAN is 2.07, from 2018. Version 2.08 exists only in the git repository.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/31/2026
HTML::FormFu versions through 2.08 for Perl are susceptible to a critical resource exhaustion vulnerability stemming from an unbounded repeat count mechanism within Repeatable elements. This flaw allows attackers to trigger excessive memory and CPU consumption by manipulating query string parameters associated with form processing logic. The core technical deficiency lies in the validation process, where the system reads a counter value specified via the named query string parameter but performs only a rudimentary check to ensure it is a positive integer. There are no upper bounds or configuration attributes available to application developers that would allow them to impose reasonable limits on this count before the cloning operation begins. Consequently, any arbitrary large integer provided by an external actor will be accepted and processed without restriction, leading directly to system instability.
The operational impact of this vulnerability is severe due to the exponential nature of resource consumption during form processing. When a Repeatable element with a set counter_name is encountered, its process method initiates a loop that deep-clones the element's child subtree for each iteration defined by the repeat count. This cloning operation is computationally expensive and memory-intensive. The vulnerability is particularly dangerous because this counting logic executes on every request prior to determining whether the form was actually submitted. This means that even simple GET requests, which typically carry no credentials or session data, can trigger the clone loop if they contain the malicious parameter in the query string. An attacker does not need authentication or a valid session state to exploit this flaw, making it accessible for denial-of-service attacks against public-facing endpoints.
The severity of the resource exhaustion is further amplified by nested Repeatable elements within the form structure. If a Repeatable element contains another Repeatable element, each level requires its own counter parameter in the query string. The multiplication effect becomes significant; for instance, an outer repeat count of one hundred combined with an inner repeat count of one hundred results in ten thousand cloned instances being generated simultaneously. This nested cloning strategy rapidly depletes available system resources. Furthermore, once a form is submitted and validation occurs, each cloned field's constraints invoke the _find_field_value method to scan the entire element tree. This scanning process adds additional computational overhead that grows faster than linearly with respect to the repeat count, accelerating memory exhaustion and CPU saturation until the application or server crashes.
From a classification perspective, this vulnerability aligns with CWE-400, which describes Uncontrolled Resource Consumption, as well as CWE-770, Allocation of Resources Without Limits or Throttling. The attack vector is consistent with ATT&CK technique T1496, Resource Hijacking, where an adversary uses computing resources to disrupt service availability rather than stealing data. Mitigation strategies should focus on implementing strict input validation that enforces a maximum allowable value for repeat counters before they are passed to the cloning logic. Developers must also consider applying rate limiting at the web server or application firewall level to prevent rapid successive requests with high counter values. Additionally, upgrading to newer versions of HTML::FormFu where this issue may have been addressed is recommended, although users should note that version 2.08 exists only in the git repository while the latest CPAN release remains older, necessitating careful evaluation of patch availability and source code modifications for immediate remediation.