CGI up to 4.x Upload lib/CGI.pm read_postdata_putdata DISABLE_UPLOADS infinite loop

Summaryinfo

A vulnerability has been found in CGI up to 4.x and classified as problematic. The affected element is the function read_postdata_putdata of the file lib/CGI.pm of the component Upload. This manipulation of the argument DISABLE_UPLOADS causes infinite loop. The identification of this vulnerability is CVE-2026-120651. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in CGI up to 4.x. It has been declared as problematic. Affected by this vulnerability is the function read_postdata_putdata of the file lib/CGI.pm of the component Upload. The manipulation of the argument DISABLE_UPLOADS with an unknown input leads to a infinite loop vulnerability. The CWE definition for the vulnerability is CWE-835. The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. As an impact it is known to affect availability. The summary by CVE is:

CGI versions before 5.00 for Perl allow an infinite loop on a short request body when $DISABLE_UPLOADS is set. When $CGI::PUTDATA_UPLOAD or an upload hook is set, read_postdata_putdata takes a request body that is not a form submission. With $CGI::DISABLE_UPLOADS set, it discards the body by reading until Content-Length bytes have arrived. Once a body shorter than its Content-Length runs out, every read returns 0, so the loop never ends. A client can keep a server process spinning with one such request.

The advisory is shared at metacpan.org. This vulnerability is known as CVE-2026-120651 since 11/02/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

Upgrading to version 5.00 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• CGI

Version

• 4.x

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion