CVE-2026-123776

RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset, , so a FIFO or device path blocks the CGI process. The normalizeparams method sends any query key matching /tz/i to tz, which sets $ENVTZ to that value, with no validation. It then calls tzset. gli...

EUVD-2026-119210

RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset, , so a FIFO or device path blocks the CGI process. The normalizeparams method sends any query key matching /tz/i to tz, which sets $ENVTZ to that value, with no validation. It then calls tzset. gli...

CVE-2026-123776

The RRD::CGI::Image Perl module (versions through 0.01 ) is vulnerable to a Denial of Service (DoS) condition. The root cause is located in the normalize_params method, which accepts CGI query parameters matching /tz/i and passes them to tz() without validation. This sets the $ENV{TZ} environment...

CVE-2026-123776 RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset(), , so a FIFO or device path blocks the CGI process

RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset, , so a FIFO or device path blocks the CGI process. The normalizeparams method sends any query key matching /tz/i to tz, which sets $ENVTZ to that value, with no validation. It then calls tzset. gli...

PT-2026-139451

RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset, , so a FIFO or device path blocks the CGI process. The normalize params method sends any query key matching /tz/i to tz, which sets $ENVTZ to that value, with no validation. It then calls tzset...