# CVE-2026-120650: CGI for Perl resource exhaustion via missing upload limits

Source: https://junglewise.ai/threats/cve-2026-120650-cgi-versions-before-5-00-for-perl-allow-memory-cpu-and-disk  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-120650 · Severity: info · Published 2026-11-04

CGI is a Perl library that web applications use to handle HTTP requests. Missing or unenforced limits on request size, parameter counts, and file uploads allow attackers to exhaust a server's memory, CPU, and disk capacity by sending specially crafted requests, causing the application to become unavailable.

Technologies: [Perl CGI](https://junglewise.ai/threats/technologies/perl-cgi). Vendors: [Perl](https://junglewise.ai/threats/vendors/perl).

## Quick answers

**Is CVE-2026-120650 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120650 being exploited in the wild.

**How severe is CVE-2026-120650?** Informational severity, published 4 November 2026.

**Which products and versions are affected?** Perl CGI before 5.00.

**Is there a fix for CVE-2026-120650?** Yes: fixed in CGI 5.00. Until then: Set $CGI::POST_MAX to a finite value appropriate for your application and enforce limits on the number of parameters and uploads; alternatively, restrict POST request body sizes at the web server or reverse proxy level. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120650 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-120650?** Check whether you run Perl CGI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in CGI 5.00

Set $CGI::POST_MAX to a finite value appropriate for your application and enforce limits on the number of parameters and uploads; alternatively, restrict POST request body sizes at the web server or reverse proxy level.

## Technical details

The CGI library fails to enforce limits on POST request bodies, multipart parameters, and file uploads. The $CGI::POST_MAX variable defaults to unlimited and is not enforced for chunked multipart bodies or boundary lines; bodies are read entirely into memory in a single operation without size constraints. An attacker can send requests with unbounded body sizes or parameter counts over the network, triggering memory exhaustion and denial of service.

## Affected products

- Perl CGI before 5.00

## Timeline

- 2026-11-04: disclosed

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/leejo/CGI.pm/commit/17b838dc14d2b82ae6c7e76f66ec2c3f3b08038b.patch](https://github.com/leejo/CGI.pm/commit/17b838dc14d2b82ae6c7e76f66ec2c3f3b08038b.patch)

## Related threats

- [Perl CGI infinite loop in read_postdata_putdata with disabled uploads](https://junglewise.ai/threats/cve-2026-120651-cgi-versions-before-5-00-for-perl-allow-an-infinite-loop-on-a)
- [Perl CGI HTML injection via comment delimiter](https://junglewise.ai/threats/cve-2026-120648-cgi-versions-before-5-00-for-perl-allow-html-injection-via-text)
- [Perl CGI header attachment parameter injection](https://junglewise.ai/threats/cve-2026-120647-cgi-versions-before-5-00-for-perl-allow-content-disposition)
- [Perl CGI cross-site scripting in url and self_url](https://junglewise.ai/threats/cve-2026-120643-cgi-versions-from-4-62-before-5-00-for-perl-allow-cross-site)
- [Perl CGI taint bypass via request-derived values](https://junglewise.ai/threats/cve-2026-120642-cgi-versions-before-5-00-for-perl-return-request-derived-values)