========================================================================
CVE-2026-120632                                      CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-120632

  Distribution:  CGI
      Versions:  before 5.00
      MetaCPAN:  https://metacpan.org/dist/CGI
      VCS Repo:  https://github.com/leejo/CGI.pm

CGI versions before 5.00 for Perl allow CPU exhaustion via a
backtracking regex on the XForms multipart/related Content-Type

Description
-----------
CGI versions before 5.00 for Perl allow CPU exhaustion via a
backtracking regex on the XForms multipart/related Content-Type.

When a POST Content-Type contains multipart/related, the boundary and
start parameters are extracted with an unanchored pattern that puts .+
on either side of the boundary capture, which backtracks in cubic time
on a header that does not match. No request body is needed.

Problem types
-------------
- CWE-1333 Inefficient Regular Expression Complexity

Workarounds
-----------
For deployments that cannot upgrade, reject Content-Type request
headers longer than 1KB at the web server.

Solutions
---------
Upgrade to CGI 5.00 or later.

References
----------
https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm
https://metacpan.org/release/LEEJO/CGI-5.00/changes
https://github.com/leejo/CGI.pm/commit/1e529c7ac8d410a51b4b04ab9d6cc00d51ef33c0.patch