Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-118993— CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI

Quick assessment

Affected
CVE-2026-118993
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 平台的 CallBackery 在 0.62.0 版本之前存在拒绝服务（DoS）漏洞。该漏洞源于 CGI、FastCGI 和 PSGI 环境下，请求路径被作为正则表达式进行插值处理。 由 函数安装的 钩子，会通过替换操作从请求 URI 末尾移除 。该替换操作在未加引号的情况下直接插值 。在 CGI、FastCGI 和 PSGI 环境中， 和匹配模式均源自客户端请求，因此攻击者可同时控制正则表达式模式及其匹配目标字符串。 攻击者只需发送一个简短的未认证请求，并在路径中包含反向引用（backreference

AI Predicted 7.5 Difficulty: Trivial

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
None None < 0.62.0 affected

I. Basic Information for CVE-2026-118993

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI
Source: CVE Program / CVE List V5
Vulnerability Description
CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI. The before_dispatch hook installed by startup() removes PATH_INFO from the end of the request URI with a substitution that interpolates PATH_INFO unquoted. Under CGI, FastCGI and PSGI both values come from the request, so the client chooses both the pattern and the string it is matched against. A short unauthenticated request with a backreference in the path backtracks exponentially and can keep a worker process busy for minutes.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1333
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 0.62.0 -

II. Public POCs for CVE-2026-118993

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-118993

请登录查看更多情报信息。

Other References for CVE-2026-118993 (1)

IV. Related Vulnerabilities

Same weakness: CWE-1333