CVE-2026-118993

CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI. The beforedispatch hook installed by startup removes PATHINFO from the end of the request URI with a substitution that interpolates PATHINFO...