CVE-2026-120651

🗓️ 04 Nov 2026 00:03:28Reported by redhat.comType

A flaw was found in perl-cgi. A remote attacker can trigger a denial of service (DoS) by sending an HTTP request containing a body shorter than its declared Content-Length header. When file upload processing is disabled, the server enters an infin...

Reporter	Title	Published	Views	Family All 6
CVE	CVE-2026-120651	3 Nov 202623:41	–	cve
Cvelist	CVE-2026-120651 CGI versions before 5.00 for Perl allow an infinite loop on a short request body when $DISABLE_UPLOADS is set	3 Nov 202623:41	–	cvelist
EUVD	EUVD-2026-116617	4 Nov 202600:32	–	euvd
NVD	CVE-2026-120651	4 Nov 202600:17	–	nvd
Positive Technologies	PT-2026-136757	3 Nov 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-120651: Loop with Unreachable Exit Condition ('Infinite Loop')	4 Nov 202600:00	–	rapid7

Source	Link
cve	www.cve.org/CVERecord
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-120651
github	www.github.com/leejo/CGI.pm/commit/16d9f61acf8b844b7360e8d726338e3ce34dfa9f.patch
github	www.github.com/leejo/CGI.pm/commit/8a78305065690461ae283fa24e5ebe4ec8a22fbc.patch
metacpan	www.metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm
metacpan	www.metacpan.org/release/LEEJO/CGI-5.00/changes
bugzilla	www.bugzilla.redhat.com/show_bug.cgi

04 Nov 2026 00:09Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.5