CGI's cookie method reads the Cookie request header through parse, which interpolates the header's expires value unescaped into the substitution pattern that removes it from the cookie string.
A client can make the request die with an invalid pattern, or tie up the process with one that backtracks catastrophically.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
Upgrade to CGI 5.00 or later.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 04 Nov 2026 00:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | CGI::Cookie versions from 4.67 before 5.00 for Perl allow denial of service via the client cookie expires value used as a regex in parse. CGI's cookie method reads the Cookie request header through parse, which interpolates the header's expires value unescaped into the substitution pattern that removes it from the cookie string. A client can make the request die with an invalid pattern, or tie up the process with one that backtracks catastrophically. | |
| Title | CGI::Cookie versions from 4.67 before 5.00 for Perl allow denial of service via the client cookie expires value used as a regex in parse | |
| Weaknesses | CWE-1333 CWE-625 |
|
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-11-03T23:39:55.189Z
Reserved: 2026-11-02T17:36:13.881Z
Link: CVE-2026-120631
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-04T00:17:24.187
Modified: 2026-11-04T00:17:24.187
Link: CVE-2026-120631
Redhat
No data.
OpenCVE Enrichment
No data.