Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-118993

CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
CPANSec

Description

CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI. The before_dispatch hook installed by startup() removes PATH_INFO from the end of the request URI with a substitution that interpolates PATH_INFO unquoted. Under CGI, FastCGI and PSGI both values come from the request, so the client chooses both the pattern and the string it is matched against. A short unauthenticated request with a backreference in the path backtracks exponentially and can keep a worker process busy for minutes.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

CallBackery

Default version status: unaffected

  • 0 to < 0.62.0affected
pkg:cpan/CallBackery

References