CVE-2026-123776 in RRD::CGI::Image
Сводка
по VulDB • 07.11.2026
RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containing "tz" to tzset(), , so a FIFO or device path blocks the CGI process.
The normalize_params method sends any query key matching /tz/i to tz(), which sets $ENV{TZ} to that value, with no validation. It then calls tzset(). glibc treats a TZ value starting with / or : as a file path and opens it, so a value naming a FIFO or a blocking device stalls the process inside tzset().
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.