CVE-2022-4993 HTML::FormHandler versions through 0.40068 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template

[
  {
    "collectionURL": "https://cpan.org/modules",
    "defaultStatus": "unaffected",
    "modules": [
      "HTML::FormHandler"
    ],
    "packageName": "HTML-FormHandler",
    "packageURL": "pkg:cpan/HTML-FormHandler",
    "programFiles": [
      "lib/HTML/FormHandler/Validate.pm",
      "lib/HTML/FormHandler/Field.pm",
      "lib/HTML/FormHandler/I18N.pm",
      "lib/HTML/FormHandler/I18N/en_us.pm"
    ],
    "programRoutines": [
      {
        "name": "HTML::FormHandler::Validate::_apply_actions"
      },
      {
        "name": "HTML::FormHandler::Field::add_error"
      },
      {
        "name": "HTML::FormHandler::Field::default_localize"
      },
      {
        "name": "HTML::FormHandler::I18N::maketext"
      }
    ],
    "repo": "https://github.com/gshank/html-formhandler",
    "versions": [
      {
        "lessThanOrEqual": "0.40068",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]