CVE-2026-120651

CGI versions before 5.00 for Perl allow an infinite loop on a short request body when $DISABLEUPLOADS is set. When $CGI::PUTDATAUPLOAD or an upload hook is set, readpostdataputdata takes a request body that is not a form submission. With $CGI::DISABLEUPLOADS set, it discards the body by reading...