CVE-2026-120645: vulnerability in CGI
CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrolling_list
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.4%
CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrolling_list.
When rendering option groups, scrolling_list marks the selected options by interpolating each selected value, by default taken from the request parameters, unescaped into a substitution pattern.
A client can make the request die with an invalid pattern, or tie up the process with one that backtracks heavily.
Affected products
CGIRelated CVEs — CGI
In the same product, most dangerous first.
CVE-2026-120631—CGI::Cookie versions from 4.67 before 5.00 for Perl allow denial of service via the client cookie expires value used as a regex in parseEPSS 0.4%CVE-2026-120639—CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipart_start and do_pushEPSS 0.2%CVE-2026-120636—CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_formEPSS 0.2%CVE-2026-120648—CGI versions before 5.00 for Perl allow HTML injection via text containing --> in commentEPSS 0.2%CVE-2026-120643—CGI versions from 4.62 before 5.00 for Perl allow cross-site scripting via a raw apostrophe in URLs returned by url and self_urlEPSS 0.2%CVE-2026-120647—CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filenameEPSS 0.2%