Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-120650— CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits

Quick assessment

Affected
CVE-2026-120650
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 的 CGI 模块在 5.00 之前的版本中，由于缺少或未强制执行请求大小、参数数量及上传大小的限制，允许攻击者耗尽内存、CPU 和磁盘资源。 默认值为无限制；即使设置了该变量，对于分块（chunked）的多部分（multipart）主体，或缺少 参数的多部分主体的边界行，该限制也不会被强制执行。此外，保存为 PUTDATA、POSTDATA 或 PATCHDATA 上传的主体会一次性全部读入内存，且没有任何机制限制参数数量或上传次数。

AI Predicted 9.8 Difficulty: Trivial

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

I. Basic Information for CVE-2026-120650

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits
Source: CVE Program / CVE List V5
Vulnerability Description
CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits. $CGI::POST_MAX defaults to no limit, and when set is not enforced for chunked multipart bodies or for the boundary line of a multipart body without a boundary= parameter. Bodies saved as PUTDATA, POSTDATA or PATCHDATA uploads are read into memory in one go, and nothing limits the number of parameters or uploads.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 5.00 -

II. Public POCs for CVE-2026-120650

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-120650

请登录查看更多情报信息。

Other References for CVE-2026-120650 (6)

IV. Related Vulnerabilities

Same weakness: CWE-770