Няма оценка
CVSS
Няма данни
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Няма потвърждение
Атакува се
Няма данни
Време до експлоатация
Описание
Оригинално описание
CGI::Cookie versions from 4.67 before 5.00 for Perl allow denial of service via the client cookie expires value used as a regex in parse. CGI's cookie method reads the Cookie request header through parse, which interpolates the header's expires value unescaped into the substitution pattern that removes it from the cookie string. A client can make the request die with an invalid pattern, or tie up the process with one that backtracks catastrophically.
Засегнати продукти
- : 4.67 преди 5.00
Вид слабост
История
- 3 ноември 2026 Публикувано
Първоизточници
- https://www.cve.org/CVERecord?id=CVE-2026-120631
- https://nvd.nist.gov/vuln/detail/CVE-2026-120631
- https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI/Cookie.pm
- https://metacpan.org/release/LEEJO/CGI-5.00/changes
- https://github.com/leejo/CGI.pm/commit/95e044af2ec24d99a61e99d6291580ad47aff641.patch