Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-19873— HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements

Quick assessment

Affected
CVE-2026-19873
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是该漏洞描述信息的中文翻译： HTML::FormFu（Perl）2.08 及更早版本存在资源耗尽漏洞，原因是在“可重复（Repeatable）”元素中，来自查询字符串的重复次数没有上限。 漏洞机制： 当“可重复”元素设置了 时，其 方法会从该命名的查询字符串参数中读取重复次数，仅检查该值是否为正整数，并将其传递给 方法，而该方法会在每次迭代中对元素的子树进行深度克隆。由于没有对数值设置上限，应用程序也无法通过任何属性来施加限制。 攻击场景： 该计数值在每个请求中读取，发生在表单判断是否已提交之前，因此一个简单

AI Predicted 6.5 Difficulty: Easy

Affected Version Matrix 1

VendorProduct Version RangeStatus
None None ≤ 2.08 affected

I. Basic Information for CVE-2026-19873

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements
Source: CVE Program / CVE List V5
Vulnerability Description
HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements. When a Repeatable element has counter_name set, its process method reads the repeat count from the named query string parameter, checks only that it is a positive integer, and passes it to repeat, which deep-clones the element's child subtree once per iteration. Nothing caps the value, and no attribute lets an application impose a limit. The count is read on every request, before the form decides whether it was submitted, so a plain GET reaches the clone loop with no credentials, no session and no request body. Nesting multiplies: a Repeatable inside a Repeatable takes a counter at each level, so an outer and an inner value of 100 build 10,000 clones. Once the form is submitted, each cloned field's constraints scan the whole element tree in _find_field_value, so cost grows faster than linearly with the count. A single request exhausts memory and CPU. The latest release on CPAN is 2.07, from 2018. Version 2.08 exists only in the git repository.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1284
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 2.08 -

II. Public POCs for CVE-2026-19873

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-19873

请登录查看更多情报信息。

Other References for CVE-2026-19873 (2)

IV. Related Vulnerabilities

Same weakness: CWE-1284

V. Comments for CVE-2026-19873

No comments yet

Leave a comment