CVE-2026-123776— RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset(), , so a FIFO or device path blocks the CGI process

Quick assessment

Affected

CVE-2026-123776

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 环境下的 RRD::CGI::Image 模块（0.01 版本及更早版本）存在安全漏洞：该模块会将包含 "tz" 的 CGI 查询参数直接传递给 tzset() 函数。攻击者可利用此缺陷，通过指定命名管道（FIFO）或阻塞设备路径作为参数，导致 CGI 进程被挂起。具体而言，normalize_params 方法会将任何匹配正则表达式 /tz/i 的查询键传递给 tz() 函数，该函数会将对应值直接赋值给环境变量 $ENV{TZ}，且未进行任何验证。随后，程序调用 tzset()。在 glibc 实现中

AI Predicted 5.3 Difficulty: Easy Updated Nov 08, 2026

Possible ATT&CK Techniques 2 AI

T1068 · Exploitation for Privilege Escalation T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
None	None	`≤ 0.01`	affected

Updated Nov 08, 2026

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset(), , so a FIFO or device path blocks the CGI process

Source: CVE Program / CVE List V5

Vulnerability Description

RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset(), , so a FIFO or device path blocks the CGI process. The normalize_params method sends any query key matching /tz/i to tz(), which sets $ENV{TZ} to that value, with no validation. It then calls tzset(). glibc treats a TZ value starting with / or : as a file path and opens it, so a value naming a FIFO or a blocking device stalls the process inside tzset().

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

CWE-1287

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
-	-	0 ~ 0.01	-

II. Public POCs for CVE-2026-123776

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-123776

请登录查看更多情报信息。

Other References for CVE-2026-123776 (3)

https://man7.org/linux/man-pages/man3/tzset.3.html technical-description
https://rt.cpan.org/Ticket/Display.html?id=182627 vendor-advisory issue-tracking patch
https://security.metacpan.org/patches/R/RRD-CGI-Image/0.01/CVE-2026-123776-r1.patch patch

https://www.cve.org/CVERecord?id=CVE-2026-123776

IV. Related Vulnerabilities

Same weakness: CWE-1287