When a POST Content-Type contains multipart/related, the boundary and start parameters are extracted with an unanchored pattern that puts .+ on either side of the boundary capture, which backtracks in cubic time on a header that does not match. No request body is needed.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
Upgrade to CGI 5.00 or later.
Vendor Workaround
For deployments that cannot upgrade, reject Content-Type request headers longer than 1KB at the web server.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 04 Nov 2026 00:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | CGI versions before 5.00 for Perl allow CPU exhaustion via a backtracking regex on the XForms multipart/related Content-Type. When a POST Content-Type contains multipart/related, the boundary and start parameters are extracted with an unanchored pattern that puts .+ on either side of the boundary capture, which backtracks in cubic time on a header that does not match. No request body is needed. | |
| Title | CGI versions before 5.00 for Perl allow CPU exhaustion via a backtracking regex on the XForms multipart/related Content-Type | |
| Weaknesses | CWE-1333 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-11-03T23:40:01.071Z
Reserved: 2026-11-02T17:39:55.528Z
Link: CVE-2026-120632
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-04T00:17:24.320
Modified: 2026-11-04T00:17:24.320
Link: CVE-2026-120632
Redhat
No data.
OpenCVE Enrichment
No data.