GHSA-HFR4-8RJC-97M2 Active Storage: Possible circumvention of file size limits in Active Storage direct uploads to Google Cloud Storage

Impact ActiveStorage::Service::GCSServiceurlfordirectupload does not bind the declared content length into the signed direct-upload URL, and headersfordirectupload returns no length constraint, so the URL authorizes an upload body of any size. A direct-upload client could store a file larger than...

Active Storage: Possible circumvention of file size limits in Active Storage direct uploads to Google Cloud Storage

Impact ActiveStorage::Service::GCSServiceurlfordirectupload does not bind the declared content length into the signed direct-upload URL, and headersfordirectupload returns no length constraint, so the URL authorizes an upload body of any size. A direct-upload client could store a file larger than...

CVE-2026-126085

The Active Storage component in Rails (prior to versions 8.1.4.1 and 8.0.5.2 ) is vulnerable to a circumvention of file size limits during direct uploads to Google Cloud Storage . The root cause is that ActiveStorage::Service::GCSService#url_for_direct_upload fails to bind the declared content le...

CVE-2026-126085 Active Storage: Possible circumvention of file size limits in Active Storage direct uploads to Google Cloud Storage

Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Service::GCSServiceurlfordirectupload does not bind the declared content length into the signed direct-upload URL, and...

CVE-2026-126085 Active Storage: Possible circumvention of file size limits in Active Storage direct uploads to Google Cloud Storage

Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Service::GCSServiceurlfordirectupload does not bind the declared content length into the signed direct-upload URL, and...

SUSE CVE-2026-120650

CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits. $CGI::POSTMAX defaults to no limit, and when set is not enforced for chunked multipart bodies or for the boundary line of a multipart body without a boundar...

EUVD-2026-116616

CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits. $CGI::POSTMAX defaults to no limit, and when set is not enforced for chunked multipart bodies or for the boundary line of a multipart body without a boundar...

AZL-112786 CVE-2026-120650 affecting package perl-CGI 4.60-1

CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits. $CGI::POSTMAX defaults to no limit, and when set is not enforced for chunked multipart bodies or for the boundary line of a multipart body without a boundar...

CVE-2026-120650

CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits. $CGI::POSTMAX defaults to no limit, and when set is not enforced for chunked multipart bodies or for the boundary line of a multipart body without a boundar...

DEBIAN-CVE-2026-120650

CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits. $CGI::POSTMAX defaults to no limit, and when set is not enforced for chunked multipart bodies or for the boundary line of a multipart body without a boundar...

UBUNTU-CVE-2026-120650

CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits. $CGI::POSTMAX defaults to no limit, and when set is not enforced for chunked multipart bodies or for the boundary line of a multipart body without a boundar...

CVE-2026-120650

CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits. $CGI::POSTMAX defaults to no limit, and when set is not enforced for chunked multipart bodies or for the boundary line of a multipart body without a boundar...

Linux Distros Unpatched Vulnerability : CVE-2026-120650

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits. $CGI::POSTMAX...

PT-2026-147267

CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits. $CGI::POST MAX defaults to no limit, and when set is not enforced for chunked multipart bodies or for the boundary line of a multipart body without a...

CVE-2026-120650 CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits

CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits. $CGI::POSTMAX defaults to no limit, and when set is not enforced for chunked multipart bodies or for the boundary line of a multipart body without a boundar...

CVE-2026-120650

Versions of CGI.pm for Perl prior to 5.00 are vulnerable to memory, CPU, and disk exhaustion . The root cause is the lack of enforced limits on request sizes, parameters, and uploads. Specifically, the $CGI::POST_MAX variable defaults to no limit and is not enforced for chunked multipart bodies o...

CVE-2026-120650

CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits. $CGI::POSTMAX defaults to no limit, and when set is not enforced for chunked multipart bodies or for the boundary line of a multipart body without a boundar...

CVE-2026-120650 CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits

CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits. $CGI::POSTMAX defaults to no limit, and when set is not enforced for chunked multipart bodies or for the boundary line of a multipart body without a boundar...

CVE-2026-120650 CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits

CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits. $CGI::POSTMAX defaults to no limit, and when set is not enforced for chunked multipart bodies or for the boundary line of a multipart body without a boundar...

PT-2026-136756

Name of the Vulnerable Software and Affected Versions CGI for Perl versions prior to 5.00 Description Resource exhaustion affecting memory, CPU, and disk can occur due to missing or unenforced limits on request size, parameters, and uploads. The variable $CGI::POST MAX defaults to no limit and is...