CVE-2026-118993: отказ на услуга

Описание

Оригинално описание

CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI. The before_dispatch hook installed by startup() removes PATH_INFO from the end of the request URI with a substitution that interpolates PATH_INFO unquoted. Under CGI, FastCGI and PSGI both values come from the request, so the client chooses both the pattern and the string it is matched against. A short unauthenticated request with a backreference in the path backtracks exponentially and can keep a worker process busy for minutes.

Засегнати продукти

• : преди 0.62.0

Вид слабост

• CWE-1333 Inefficient Regular Expression Complexity

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-118993
• https://nvd.nist.gov/vuln/detail/CVE-2026-118993
• https://metacpan.org/release/OETIKER/CallBackery-0.62.0/changes