Quick answers
- Is CVE-2026-120651 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-120651 being exploited in the wild.
- How severe is CVE-2026-120651?
- Informational severity, published 4 November 2026.
- Which products and versions are affected?
- Perl CGI before 5.00.
- Is there a fix for CVE-2026-120651?
- Yes: fixed in CGI 5.00. Until then: Disable the $CGI::PUTDATA_UPLOAD feature or remove upload hooks if uploads are not required, which prevents the vulnerable code path from being reached. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-120651 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-120651?
- Check whether you run Perl CGI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: CGI 5.00
Disable the $CGI::PUTDATA_UPLOAD feature or remove upload hooks if uploads are not required, which prevents the vulnerable code path from being reached.
Technical details
When $CGI::DISABLE_UPLOADS is set alongside $CGI::PUTDATA_UPLOAD or an upload hook, the read_postdata_putdata function attempts to discard a request body by reading until the Content-Length limit is reached. If the client sends fewer bytes than Content-Length and then closes the connection, each subsequent read returns 0 or undef, but the loop never exits, causing an infinite spin. This is a denial-of-service attack vector requiring only network access to send a single malformed request.
Affected products
- Perl CGI before 5.00
Timeline
- 2026-11-04: disclosed
- 2026-11-02: patched: Fix committed