CVE-2026-120645— CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrolling_list

Quick assessment

Affected

CVE-2026-120645

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 的 CGI 模块在 5.00 版本之前存在拒绝服务漏洞：攻击者可通过提交特定值，将其用作中选项选择时的正则表达式，从而触发服务中断。在渲染选项组时，会将每个被选中的值（默认取自请求参数）未经转义地插值到一个替换模式中，以标记已选选项。攻击者可构造包含无效模式的请求，导致请求处理过程崩溃；或提交一个引发严重回溯（heavy backtracking）的正则表达式，从而耗尽系统资源，使进程长时间挂起。

AI Predicted 5.3 Difficulty: Trivial EPSS 0.39% · P33 Updated Nov 04, 2026

Possible ATT&CK Techniques 2 AI

T1499 · Endpoint Denial of Service T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
None	None	`< 5.00`	affected

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrolling_list

Source: CVE Program / CVE List V5

Vulnerability Description

CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrolling_list. When rendering option groups, scrolling_list marks the selected options by interpolating each selected value, by default taken from the request parameters, unescaped into a substitution pattern. A client can make the request die with an invalid pattern, or tie up the process with one that backtracks heavily.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

CWE-1333

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
-	-	0 ~ 5.00	-

II. Public POCs for CVE-2026-120645

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120645

请登录查看更多情报信息。

Other References for CVE-2026-120645 (3)

https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm technical-description
https://metacpan.org/release/LEEJO/CGI-5.00/changes release-notes
https://github.com/leejo/CGI.pm/commit/824956fbb0c4eb77044ba2dc9180a30df12cb309.patch patch

https://www.cve.org/CVERecord?id=CVE-2026-120645

IV. Related Vulnerabilities

Same weakness: CWE-1333