# CVE-2026-120632: CGI module for Perl ReDoS via multipart/related Content-Type

Source: https://junglewise.ai/threats/cve-2026-120632-cgi-versions-before-5-00-for-perl-allow-cpu-exhaustion-via-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-120632 · Severity: info · Published 2026-11-04

The CGI module for Perl contains a regular expression parsing bug in how it handles HTTP POST requests with multipart/related Content-Type headers. An attacker can send a specially crafted header with repeated parameters to cause the server to spend excessive CPU time parsing it, leading to a denial of service without needing to send any request body.

Technologies: [Perl CGI](https://junglewise.ai/threats/technologies/perl-cgi). Vendors: [Perl](https://junglewise.ai/threats/vendors/perl).

## Quick answers

**Is CVE-2026-120632 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120632 being exploited in the wild.

**How severe is CVE-2026-120632?** Informational severity, published 4 November 2026.

**Which products and versions are affected?** Perl CGI before 5.00.

**Is there a fix for CVE-2026-120632?** Yes: fixed in CGI 5.00. Until then: The fix refactors the pattern into separate linear-time matches for boundary= and start= parameters instead of a single pattern with backtracking, and requires the Content-Type to begin with multipart/related rather than contain it anywhere. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120632 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-120632?** Check whether you run Perl CGI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in CGI 5.00

The fix refactors the pattern into separate linear-time matches for boundary= and start= parameters instead of a single pattern with backtracking, and requires the Content-Type to begin with multipart/related rather than contain it anywhere.

## Technical details

The vulnerability is a regular expression denial of service (ReDoS) in the parsing of XForms multipart/related Content-Type headers. The regex pattern used .+ on either side of a repeated group, causing cubic-time backtracking O(n³) when a crafted header (such as repeated "boundary=a " with no matching "start=" parameter) fails to match. An unauthenticated remote attacker can trigger this via a POST request header with no body required.

## Affected products

- Perl CGI before 5.00

## Timeline

- 2026-11-04: disclosed
- 2026-11-02: patched

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/leejo/CGI.pm/commit/1e529c7ac8d410a51b4b04ab9d6cc00d51ef33c0.patch](https://github.com/leejo/CGI.pm/commit/1e529c7ac8d410a51b4b04ab9d6cc00d51ef33c0.patch)

## Related threats

- [Perl CGI infinite loop in read_postdata_putdata with disabled uploads](https://junglewise.ai/threats/cve-2026-120651-cgi-versions-before-5-00-for-perl-allow-an-infinite-loop-on-a)
- [CGI for Perl resource exhaustion via missing upload limits](https://junglewise.ai/threats/cve-2026-120650-cgi-versions-before-5-00-for-perl-allow-memory-cpu-and-disk)
- [Perl CGI HTML injection via comment delimiter](https://junglewise.ai/threats/cve-2026-120648-cgi-versions-before-5-00-for-perl-allow-html-injection-via-text)
- [Perl CGI header attachment parameter injection](https://junglewise.ai/threats/cve-2026-120647-cgi-versions-before-5-00-for-perl-allow-content-disposition)
- [Perl CGI cross-site scripting in url and self_url](https://junglewise.ai/threats/cve-2026-120643-cgi-versions-from-4-62-before-5-00-for-perl-allow-cross-site)