Vulnerability-Lookup

CVE-2022-4993 (GCVE-0-2022-4993)

Vulnerability from cvelistv5 – Published: 2026-08-13 16:27 – Updated: 2026-09-08 20:07

Title

Summary

HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template. add_error hands its first argument to the language handle as the Locale::Maketext message key, and the default handle's lexicon sets `_AUTO`, so a string that is not a lexicon entry is compiled as a bracket notation template instead of being looked up. In a bracket group the first token names a method called on the language handle and the remaining tokens are its arguments. Three kinds of text the library did not author reach that position. _apply_actions installs a `$SIG{__WARN__}` handler that stores the warning text in `$error_message`, and a captured warning survives a successful action, so a field carrying a numeric transform turns `Argument "[sprintf,%50000000d,0]" isn't numeric` into the template; a warning quotes the submitted value verbatim, so the group is well formed and dispatches. `$error_message ||= $tobj->validate($new_value)` takes a type constraint's own failure message, which renders the rejected value through a partial dumper in bracket and comma form (Devel::PartialDump when Moose can load it, Type::Tiny's own dumper always), so a field with `apply => [ Str ]` given a parameter sent more than once, which arrives as an array, gets `Reference ["a","b"] did not pass type constraint "Str"` as its template, from a request that carries no bracket character of its own. A coercion or transform exception reaches it the same way. Beyond those, a validator whose message contains the field value puts that value in the template directly, and add_error replaces the message list with the contents of an arrayref first argument (`@message = @{$message[0]} if ref $message[0] eq 'ARRAY'`), so a value arriving as an array fills the argument slots from the same request as well. A malformed group such as `[0]` makes the compile croak, and HTML::FormHandler::I18N::maketext and add_error each re-raise that as a die, so process() throws. A well formed group naming sprintf reaches CORE::sprintf with an attacker chosen field width. Any caller that applies a type constraint or a transform to an untrusted field, or whose validator passes an untrusted field value to add_error, can be made to throw an unhandled exception out of process(), or to allocate an arbitrary amount of memory in one request, and an application whose language handle subclass defines side effecting public methods makes those callable with attacker chosen arguments. The dumped type constraint message is bounded to the exception, because both dumpers quote non-numeric elements so the method slot is never an attacker chosen name. The built-in messages pass fixed templates with the value in an argument slot, where it stays inert, and the built-in field types attach explicit message callbacks, so neither is affected.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 11:14 UTC

CWE

CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine
CWE-470 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Assigner

CPANSec CNA under the redhat root

CNA scorecard C 61/100 over 360 records in the last 180 days details

References

7 references

URL	Tags
https://metacpan.org/release/ABRAXXA/HTML-FormHan…	release-notes
https://github.com/gshank/html-formhandler/commit…	patch
https://github.com/gshank/html-formhandler/pull/159	issue-tracking
https://metacpan.org/release/GSHANK/HTML-FormHand…
https://metacpan.org/release/GSHANK/HTML-FormHand…
https://metacpan.org/release/GSHANK/HTML-FormHand…
https://www.cve.org/CVERecord?id=CVE-2012-6329	related

Impacted products

1 product

Vendor	Product	Version	CPE status
		Affected: 0 , < 0.410000 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-4993",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T11:14:18.115170Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T11:14:34.478Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "modules": [
            "HTML::FormHandler"
          ],
          "packageName": "HTML-FormHandler",
          "packageURL": "pkg:cpan/HTML-FormHandler",
          "programFiles": [
            "lib/HTML/FormHandler/Validate.pm",
            "lib/HTML/FormHandler/Field.pm",
            "lib/HTML/FormHandler/I18N.pm",
            "lib/HTML/FormHandler/I18N/en_us.pm"
          ],
          "programRoutines": [
            {
              "name": "HTML::FormHandler::Validate::_apply_actions"
            },
            {
              "name": "HTML::FormHandler::Field::add_error"
            },
            {
              "name": "HTML::FormHandler::Field::default_localize"
            },
            {
              "name": "HTML::FormHandler::I18N::maketext"
            }
          ],
          "repo": "https://github.com/gshank/html-formhandler",
          "versions": [
            {
              "lessThan": "0.410000",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template.\n\nadd_error hands its first argument to the language handle as the Locale::Maketext message key, and the default handle\u0027s lexicon sets `_AUTO`, so a string that is not a lexicon entry is compiled as a bracket notation template instead of being looked up. In a bracket group the first token names a method called on the language handle and the remaining tokens are its arguments.\n\nThree kinds of text the library did not author reach that position. _apply_actions installs a `$SIG{__WARN__}` handler that stores the warning text in `$error_message`, and a captured warning survives a successful action, so a field carrying a numeric transform turns `Argument \"[sprintf,%50000000d,0]\" isn\u0027t numeric` into the template; a warning quotes the submitted value verbatim, so the group is well formed and dispatches. `$error_message ||= $tobj-\u003evalidate($new_value)` takes a type constraint\u0027s own failure message, which renders the rejected value through a partial dumper in bracket and comma form (Devel::PartialDump when Moose can load it, Type::Tiny\u0027s own dumper always), so a field with `apply =\u003e [ Str ]` given a parameter sent more than once, which arrives as an array, gets `Reference [\"a\",\"b\"] did not pass type constraint \"Str\"` as its template, from a request that carries no bracket character of its own. A coercion or transform exception reaches it the same way. Beyond those, a validator whose message contains the field value puts that value in the template directly, and add_error replaces the message list with the contents of an arrayref first argument (`@message = @{$message[0]} if ref $message[0] eq \u0027ARRAY\u0027`), so a value arriving as an array fills the argument slots from the same request as well.\n\nA malformed group such as `[0]` makes the compile croak, and HTML::FormHandler::I18N::maketext and add_error each re-raise that as a die, so process() throws. A well formed group naming sprintf reaches CORE::sprintf with an attacker chosen field width. Any caller that applies a type constraint or a transform to an untrusted field, or whose validator passes an untrusted field value to add_error, can be made to throw an unhandled exception out of process(), or to allocate an arbitrary amount of memory in one request, and an application whose language handle subclass defines side effecting public methods makes those callable with attacker chosen arguments. The dumped type constraint message is bounded to the exception, because both dumpers quote non-numeric elements so the method slot is never an attacker chosen name. The built-in messages pass fixed templates with the value in an argument slot, where it stays inert, and the built-in field types attach explicit message callbacks, so neither is affected."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1336",
              "description": "CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-470",
              "description": "CWE-470 Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T20:07:45.843Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/ABRAXXA/HTML-FormHandler-0.410001/changes"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/gshank/html-formhandler/commit/8a204d0e64d8b30f37b19604af9b979413dffd41.patch"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/gshank/html-formhandler/pull/159"
        },
        {
          "url": "https://metacpan.org/release/GSHANK/HTML-FormHandler-0.40068/source/lib/HTML/FormHandler/Validate.pm#L161-261"
        },
        {
          "url": "https://metacpan.org/release/GSHANK/HTML-FormHandler-0.40068/source/lib/HTML/FormHandler/Field.pm#L861-876"
        },
        {
          "url": "https://metacpan.org/release/GSHANK/HTML-FormHandler-0.40068/source/lib/HTML/FormHandler/I18N/en_us.pm#L9-11"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-6329"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to HTML-FormHandler 0.410000 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2022-01-10T00:00:00.000Z",
          "value": "Issue was first reported to author without a proof of concept."
        },
        {
          "lang": "en",
          "time": "2024-10-27T00:00:00.000Z",
          "value": "Issue was forwarded to CPANSec."
        },
        {
          "lang": "en",
          "time": "2026-06-22T00:00:00.000Z",
          "value": "Investigation and development of proof of concept by CPANSec, aided by LLM tooling."
        },
        {
          "lang": "en",
          "time": "2026-07-02T00:00:00.000Z",
          "value": "Issue was again reported to author with proof of concept."
        },
        {
          "lang": "en",
          "time": "2026-07-30T00:00:00.000Z",
          "value": "Additional analysis and development of patch by CPANSec, aided by LLM tooling."
        },
        {
          "lang": "en",
          "time": "2026-08-13T00:00:00.000Z",
          "value": "CVE-2022-4993 published"
        }
      ],
      "title": "HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2022-4993",
    "datePublished": "2026-08-13T16:27:47.498Z",
    "dateReserved": "2026-06-23T17:33:58.500Z",
    "dateUpdated": "2026-09-08T20:07:45.843Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-4993",
      "date": "2026-11-10",
      "epss": "0.00628",
      "percentile": "0.50442"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://cpan.org/modules",
                "defaultStatus": "unaffected",
                "modules": [
                  "HTML::FormHandler"
                ],
                "packageName": "HTML-FormHandler",
                "packageURL": "pkg:cpan/HTML-FormHandler",
                "programFiles": [
                  "lib/HTML/FormHandler/Validate.pm",
                  "lib/HTML/FormHandler/Field.pm",
                  "lib/HTML/FormHandler/I18N.pm",
                  "lib/HTML/FormHandler/I18N/en_us.pm"
                ],
                "programRoutines": [
                  {
                    "name": "HTML::FormHandler::Validate::_apply_actions"
                  },
                  {
                    "name": "HTML::FormHandler::Field::add_error"
                  },
                  {
                    "name": "HTML::FormHandler::Field::default_localize"
                  },
                  {
                    "name": "HTML::FormHandler::I18N::maketext"
                  }
                ],
                "repo": "https://github.com/gshank/html-formhandler",
                "versions": [
                  {
                    "lessThan": "0.410000",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template.\n\nadd_error hands its first argument to the language handle as the Locale::Maketext message key, and the default handle\u0027s lexicon sets `_AUTO`, so a string that is not a lexicon entry is compiled as a bracket notation template instead of being looked up. In a bracket group the first token names a method called on the language handle and the remaining tokens are its arguments.\n\nThree kinds of text the library did not author reach that position. _apply_actions installs a `$SIG{__WARN__}` handler that stores the warning text in `$error_message`, and a captured warning survives a successful action, so a field carrying a numeric transform turns `Argument \"[sprintf,%50000000d,0]\" isn\u0027t numeric` into the template; a warning quotes the submitted value verbatim, so the group is well formed and dispatches. `$error_message ||= $tobj-\u003evalidate($new_value)` takes a type constraint\u0027s own failure message, which renders the rejected value through a partial dumper in bracket and comma form (Devel::PartialDump when Moose can load it, Type::Tiny\u0027s own dumper always), so a field with `apply =\u003e [ Str ]` given a parameter sent more than once, which arrives as an array, gets `Reference [\"a\",\"b\"] did not pass type constraint \"Str\"` as its template, from a request that carries no bracket character of its own. A coercion or transform exception reaches it the same way. Beyond those, a validator whose message contains the field value puts that value in the template directly, and add_error replaces the message list with the contents of an arrayref first argument (`@message = @{$message[0]} if ref $message[0] eq \u0027ARRAY\u0027`), so a value arriving as an array fills the argument slots from the same request as well.\n\nA malformed group such as `[0]` makes the compile croak, and HTML::FormHandler::I18N::maketext and add_error each re-raise that as a die, so process() throws. A well formed group naming sprintf reaches CORE::sprintf with an attacker chosen field width. Any caller that applies a type constraint or a transform to an untrusted field, or whose validator passes an untrusted field value to add_error, can be made to throw an unhandled exception out of process(), or to allocate an arbitrary amount of memory in one request, and an application whose language handle subclass defines side effecting public methods makes those callable with attacker chosen arguments. The dumped type constraint message is bounded to the exception, because both dumpers quote non-numeric elements so the method slot is never an attacker chosen name. The built-in messages pass fixed templates with the value in an argument slot, where it stays inert, and the built-in field types attach explicit message callbacks, so neither is affected."
          },
          {
            "lang": "es",
            "value": "Las versiones de HTML::FormHandler hasta la 0.40068 para Perl permiten la distribuci\u00f3n de m\u00e9todos seleccionados por el atacante y el agotamiento de recursos porque _apply_actions y add_error utilizan texto de mensaje de error construido a partir de datos de solicitud como una plantilla de notaci\u00f3n de corchetes de Locale::Maketext.\n\nadd_error entrega su primer argumento al gestor de idioma como la clave de mensaje de Locale::Maketext, y el l\u00e9xico del gestor predeterminado establece \u2019_AUTO\u2019, por lo que una cadena que no es una entrada de l\u00e9xico se compila como una plantilla de notaci\u00f3n de corchetes en lugar de ser buscada. En un grupo de corchetes, el primer token nombra un m\u00e9todo llamado en el gestor de idioma y los tokens restantes son sus argumentos.\n\nTres tipos de texto que la biblioteca no cre\u00f3 llegan a esa posici\u00f3n. _apply_actions instala un gestor de \u2019$SIG{__WARN__}\u2019 que almacena el texto de advertencia en \u2019$error_message\u2019, y una advertencia capturada sobrevive a una acci\u00f3n exitosa, por lo que un campo que lleva una transformaci\u00f3n num\u00e9rica convierte \u2019Argument \u201c[sprintf,%50000000d,0]\u201d isn\u2019t numeric\u2019 en la plantilla; una advertencia cita el valor enviado textualmente, por lo que el grupo est\u00e1 bien formado y se distribuye. \u2019$error_message ||= $tobj  -\u003e  validate($new_value)\u2019 toma el propio mensaje de fallo de una restricci\u00f3n de tipo, que renderiza el valor rechazado a trav\u00e9s de un dumper parcial en formato de corchetes y comas (Devel::PartialDump cuando Moose puede cargarlo, el propio dumper de Type::Tiny siempre), por lo que un campo con \u2019apply =\u003e [ Str ]\u2019 al que se le da un par\u00e1metro enviado m\u00e1s de una vez, que llega como un array, obtiene \u2019Reference [\u201ca\u201d,\u201cb\u201d] did not pass type constraint \u201cStr\u201d\u2019 como su plantilla, de una solicitud que no lleva ning\u00fan car\u00e1cter de corchete propio. Una excepci\u00f3n de coerci\u00f3n o transformaci\u00f3n lo alcanza de la misma manera. M\u00e1s all\u00e1 de eso, un validador cuyo mensaje contiene el valor del campo coloca ese valor directamente en la plantilla, y add_error reemplaza la lista de mensajes con el contenido de un primer argumento arrayref (\u2019@message = @{$message[0]} if ref $message[0] eq \u2019ARRAY\u2019\u2019), por lo que un valor que llega como un array tambi\u00e9n llena las ranuras de argumentos de la misma solicitud.\n\nUn grupo mal formado como \u2019[0]\u2019 hace que la compilaci\u00f3n falle, y HTML::FormHandler::I18N::maketext y add_error cada uno lo vuelve a lanzar como un \u2019die\u2019, por lo que process() lanza una excepci\u00f3n. Un grupo bien formado que nombra a sprintf llega a CORE::sprintf con un ancho de campo elegido por el atacante. Cualquier llamador que aplique una restricci\u00f3n de tipo o una transformaci\u00f3n a un campo no confiable, o cuyo validador pase un valor de campo no confiable a add_error, puede ser forzado a lanzar una excepci\u00f3n no manejada fuera de process(), o a asignar una cantidad arbitraria de memoria en una solicitud, y una aplicaci\u00f3n cuya subclase de gestor de idioma define m\u00e9todos p\u00fablicos con efectos secundarios los hace invocables con argumentos elegidos por el atacante. El mensaje de restricci\u00f3n de tipo volcado est\u00e1 limitado a la excepci\u00f3n, porque ambos dumpers citan elementos no num\u00e9ricos, por lo que la ranura del m\u00e9todo nunca es un nombre elegido por el atacante. Los mensajes incorporados pasan plantillas fijas con el valor en una ranura de argumento, donde permanece inerte, y los tipos de campo incorporados adjuntan devoluciones de llamada de mensajes expl\u00edcitas, por lo que ninguno se ve afectado."
          }
        ],
        "id": "CVE-2022-4993",
        "lastModified": "2026-11-10T12:10:00.177",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 9.1,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.2,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2022-4993",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T11:14:18.115170Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-13T17:17:17.780",
        "references": [
          {
            "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
            "url": "https://github.com/gshank/html-formhandler/commit/8a204d0e64d8b30f37b19604af9b979413dffd41.patch"
          },
          {
            "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
            "url": "https://github.com/gshank/html-formhandler/pull/159"
          },
          {
            "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
            "url": "https://metacpan.org/release/ABRAXXA/HTML-FormHandler-0.410001/changes"
          },
          {
            "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
            "url": "https://metacpan.org/release/GSHANK/HTML-FormHandler-0.40068/source/lib/HTML/FormHandler/Field.pm#L861-876"
          },
          {
            "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
            "url": "https://metacpan.org/release/GSHANK/HTML-FormHandler-0.40068/source/lib/HTML/FormHandler/I18N/en_us.pm#L9-11"
          },
          {
            "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
            "url": "https://metacpan.org/release/GSHANK/HTML-FormHandler-0.40068/source/lib/HTML/FormHandler/Validate.pm#L161-261"
          },
          {
            "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
            "url": "https://www.cve.org/CVERecord?id=CVE-2012-6329"
          }
        ],
        "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-470"
              },
              {
                "lang": "en",
                "value": "CWE-1336"
              }
            ],
            "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-10-31T08:40:02+00:00",
      "cve": "CVE-2022-4993",
      "id": "CVE-2022-4993",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "perl-HTML-FormHandler: HTML::FormHandler: Denial of Service via crafted error messages",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-4993.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "critical",
      "current_release_date": "2026-09-11T02:35:50Z",
      "cve": "CVE-2022-4993",
      "id": "CVE-2022-4993",
      "initial_release_date": "2026-08-15T00:19:39Z",
      "product_status:recommended": "1",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-4993",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-4993.json",
      "version": "4"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "NETWORK",
                  "availabilityImpact": "NONE",
                  "baseScore": 9.1,
                  "baseSeverity": "CRITICAL",
                  "confidentialityImpact": "HIGH",
                  "integrityImpact": "HIGH",
                  "privilegesRequired": "NONE",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2022-4993",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-14T11:14:18.115170Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-14T11:14:00.368Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://cpan.org/modules",
              "defaultStatus": "unaffected",
              "modules": [
                "HTML::FormHandler"
              ],
              "packageName": "HTML-FormHandler",
              "packageURL": "pkg:cpan/HTML-FormHandler",
              "programFiles": [
                "lib/HTML/FormHandler/Validate.pm",
                "lib/HTML/FormHandler/Field.pm",
                "lib/HTML/FormHandler/I18N.pm",
                "lib/HTML/FormHandler/I18N/en_us.pm"
              ],
              "programRoutines": [
                {
                  "name": "HTML::FormHandler::Validate::_apply_actions"
                },
                {
                  "name": "HTML::FormHandler::Field::add_error"
                },
                {
                  "name": "HTML::FormHandler::Field::default_localize"
                },
                {
                  "name": "HTML::FormHandler::I18N::maketext"
                }
              ],
              "repo": "https://github.com/gshank/html-formhandler",
              "versions": [
                {
                  "lessThan": "0.410000",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template.\n\nadd_error hands its first argument to the language handle as the Locale::Maketext message key, and the default handle\u0027s lexicon sets `_AUTO`, so a string that is not a lexicon entry is compiled as a bracket notation template instead of being looked up. In a bracket group the first token names a method called on the language handle and the remaining tokens are its arguments.\n\nThree kinds of text the library did not author reach that position. _apply_actions installs a `$SIG{__WARN__}` handler that stores the warning text in `$error_message`, and a captured warning survives a successful action, so a field carrying a numeric transform turns `Argument \"[sprintf,%50000000d,0]\" isn\u0027t numeric` into the template; a warning quotes the submitted value verbatim, so the group is well formed and dispatches. `$error_message ||= $tobj-\u003evalidate($new_value)` takes a type constraint\u0027s own failure message, which renders the rejected value through a partial dumper in bracket and comma form (Devel::PartialDump when Moose can load it, Type::Tiny\u0027s own dumper always), so a field with `apply =\u003e [ Str ]` given a parameter sent more than once, which arrives as an array, gets `Reference [\"a\",\"b\"] did not pass type constraint \"Str\"` as its template, from a request that carries no bracket character of its own. A coercion or transform exception reaches it the same way. Beyond those, a validator whose message contains the field value puts that value in the template directly, and add_error replaces the message list with the contents of an arrayref first argument (`@message = @{$message[0]} if ref $message[0] eq \u0027ARRAY\u0027`), so a value arriving as an array fills the argument slots from the same request as well.\n\nA malformed group such as `[0]` makes the compile croak, and HTML::FormHandler::I18N::maketext and add_error each re-raise that as a die, so process() throws. A well formed group naming sprintf reaches CORE::sprintf with an attacker chosen field width. Any caller that applies a type constraint or a transform to an untrusted field, or whose validator passes an untrusted field value to add_error, can be made to throw an unhandled exception out of process(), or to allocate an arbitrary amount of memory in one request, and an application whose language handle subclass defines side effecting public methods makes those callable with attacker chosen arguments. The dumped type constraint message is bounded to the exception, because both dumpers quote non-numeric elements so the method slot is never an attacker chosen name. The built-in messages pass fixed templates with the value in an argument slot, where it stays inert, and the built-in field types attach explicit message callbacks, so neither is affected."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-1336",
                  "description": "CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-470",
                  "description": "CWE-470 Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-08T20:07:45.843Z",
            "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
            "shortName": "CPANSec"
          },
          "references": [
            {
              "tags": [
                "release-notes"
              ],
              "url": "https://metacpan.org/release/ABRAXXA/HTML-FormHandler-0.410001/changes"
            },
            {
              "tags": [
                "patch"
              ],
              "url": "https://github.com/gshank/html-formhandler/commit/8a204d0e64d8b30f37b19604af9b979413dffd41.patch"
            },
            {
              "tags": [
                "issue-tracking"
              ],
              "url": "https://github.com/gshank/html-formhandler/pull/159"
            },
            {
              "url": "https://metacpan.org/release/GSHANK/HTML-FormHandler-0.40068/source/lib/HTML/FormHandler/Validate.pm#L161-261"
            },
            {
              "url": "https://metacpan.org/release/GSHANK/HTML-FormHandler-0.40068/source/lib/HTML/FormHandler/Field.pm#L861-876"
            },
            {
              "url": "https://metacpan.org/release/GSHANK/HTML-FormHandler-0.40068/source/lib/HTML/FormHandler/I18N/en_us.pm#L9-11"
            },
            {
              "tags": [
                "related"
              ],
              "url": "https://www.cve.org/CVERecord?id=CVE-2012-6329"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Upgrade to HTML-FormHandler 0.410000 or later."
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "timeline": [
            {
              "lang": "en",
              "time": "2022-01-10T00:00:00.000Z",
              "value": "Issue was first reported to author without a proof of concept."
            },
            {
              "lang": "en",
              "time": "2024-10-27T00:00:00.000Z",
              "value": "Issue was forwarded to CPANSec."
            },
            {
              "lang": "en",
              "time": "2026-06-22T00:00:00.000Z",
              "value": "Investigation and development of proof of concept by CPANSec, aided by LLM tooling."
            },
            {
              "lang": "en",
              "time": "2026-07-02T00:00:00.000Z",
              "value": "Issue was again reported to author with proof of concept."
            },
            {
              "lang": "en",
              "time": "2026-07-30T00:00:00.000Z",
              "value": "Additional analysis and development of patch by CPANSec, aided by LLM tooling."
            },
            {
              "lang": "en",
              "time": "2026-08-13T00:00:00.000Z",
              "value": "CVE-2022-4993 published"
            }
          ],
          "title": "HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template",
          "x_generator": {
            "engine": "cpansec-cna-tool 0.1"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "assignerShortName": "CPANSec",
        "cveId": "CVE-2022-4993",
        "datePublished": "2026-08-13T16:27:47.498Z",
        "dateReserved": "2026-06-23T17:33:58.500Z",
        "dateUpdated": "2026-09-08T20:07:45.843Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2022-4993

Vulnerability from fkie_nvd - Published: 2026-08-13 17:17 - Updated: 2026-11-10 12:10

Severity

9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Summary

References

	URL	Tags
	9b29abf9-4ab0-4765-b253-1875cd9b441e	https://github.com/gshank/html-formhandler/commit/8a204d0e64d8b30f37b19604af9b979413dffd41.patch
	9b29abf9-4ab0-4765-b253-1875cd9b441e	https://github.com/gshank/html-formhandler/pull/159
	9b29abf9-4ab0-4765-b253-1875cd9b441e	https://metacpan.org/release/ABRAXXA/HTML-FormHandler-0.410001/changes
	9b29abf9-4ab0-4765-b253-1875cd9b441e	https://metacpan.org/release/GSHANK/HTML-FormHandler-0.40068/source/lib/HTML/FormHandler/Field.pm#L861-876
	9b29abf9-4ab0-4765-b253-1875cd9b441e	https://metacpan.org/release/GSHANK/HTML-FormHandler-0.40068/source/lib/HTML/FormHandler/I18N/en_us.pm#L9-11
	9b29abf9-4ab0-4765-b253-1875cd9b441e	https://metacpan.org/release/GSHANK/HTML-FormHandler-0.40068/source/lib/HTML/FormHandler/Validate.pm#L161-261
	9b29abf9-4ab0-4765-b253-1875cd9b441e	https://www.cve.org/CVERecord?id=CVE-2012-6329

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "modules": [
            "HTML::FormHandler"
          ],
          "packageName": "HTML-FormHandler",
          "packageURL": "pkg:cpan/HTML-FormHandler",
          "programFiles": [
            "lib/HTML/FormHandler/Validate.pm",
            "lib/HTML/FormHandler/Field.pm",
            "lib/HTML/FormHandler/I18N.pm",
            "lib/HTML/FormHandler/I18N/en_us.pm"
          ],
          "programRoutines": [
            {
              "name": "HTML::FormHandler::Validate::_apply_actions"
            },
            {
              "name": "HTML::FormHandler::Field::add_error"
            },
            {
              "name": "HTML::FormHandler::Field::default_localize"
            },
            {
              "name": "HTML::FormHandler::I18N::maketext"
            }
          ],
          "repo": "https://github.com/gshank/html-formhandler",
          "versions": [
            {
              "lessThan": "0.410000",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template.\n\nadd_error hands its first argument to the language handle as the Locale::Maketext message key, and the default handle\u0027s lexicon sets `_AUTO`, so a string that is not a lexicon entry is compiled as a bracket notation template instead of being looked up. In a bracket group the first token names a method called on the language handle and the remaining tokens are its arguments.\n\nThree kinds of text the library did not author reach that position. _apply_actions installs a `$SIG{__WARN__}` handler that stores the warning text in `$error_message`, and a captured warning survives a successful action, so a field carrying a numeric transform turns `Argument \"[sprintf,%50000000d,0]\" isn\u0027t numeric` into the template; a warning quotes the submitted value verbatim, so the group is well formed and dispatches. `$error_message ||= $tobj-\u003evalidate($new_value)` takes a type constraint\u0027s own failure message, which renders the rejected value through a partial dumper in bracket and comma form (Devel::PartialDump when Moose can load it, Type::Tiny\u0027s own dumper always), so a field with `apply =\u003e [ Str ]` given a parameter sent more than once, which arrives as an array, gets `Reference [\"a\",\"b\"] did not pass type constraint \"Str\"` as its template, from a request that carries no bracket character of its own. A coercion or transform exception reaches it the same way. Beyond those, a validator whose message contains the field value puts that value in the template directly, and add_error replaces the message list with the contents of an arrayref first argument (`@message = @{$message[0]} if ref $message[0] eq \u0027ARRAY\u0027`), so a value arriving as an array fills the argument slots from the same request as well.\n\nA malformed group such as `[0]` makes the compile croak, and HTML::FormHandler::I18N::maketext and add_error each re-raise that as a die, so process() throws. A well formed group naming sprintf reaches CORE::sprintf with an attacker chosen field width. Any caller that applies a type constraint or a transform to an untrusted field, or whose validator passes an untrusted field value to add_error, can be made to throw an unhandled exception out of process(), or to allocate an arbitrary amount of memory in one request, and an application whose language handle subclass defines side effecting public methods makes those callable with attacker chosen arguments. The dumped type constraint message is bounded to the exception, because both dumpers quote non-numeric elements so the method slot is never an attacker chosen name. The built-in messages pass fixed templates with the value in an argument slot, where it stays inert, and the built-in field types attach explicit message callbacks, so neither is affected."
    },
    {
      "lang": "es",
      "value": "Las versiones de HTML::FormHandler hasta la 0.40068 para Perl permiten la distribuci\u00f3n de m\u00e9todos seleccionados por el atacante y el agotamiento de recursos porque _apply_actions y add_error utilizan texto de mensaje de error construido a partir de datos de solicitud como una plantilla de notaci\u00f3n de corchetes de Locale::Maketext.\n\nadd_error entrega su primer argumento al gestor de idioma como la clave de mensaje de Locale::Maketext, y el l\u00e9xico del gestor predeterminado establece \u2019_AUTO\u2019, por lo que una cadena que no es una entrada de l\u00e9xico se compila como una plantilla de notaci\u00f3n de corchetes en lugar de ser buscada. En un grupo de corchetes, el primer token nombra un m\u00e9todo llamado en el gestor de idioma y los tokens restantes son sus argumentos.\n\nTres tipos de texto que la biblioteca no cre\u00f3 llegan a esa posici\u00f3n. _apply_actions instala un gestor de \u2019$SIG{__WARN__}\u2019 que almacena el texto de advertencia en \u2019$error_message\u2019, y una advertencia capturada sobrevive a una acci\u00f3n exitosa, por lo que un campo que lleva una transformaci\u00f3n num\u00e9rica convierte \u2019Argument \u201c[sprintf,%50000000d,0]\u201d isn\u2019t numeric\u2019 en la plantilla; una advertencia cita el valor enviado textualmente, por lo que el grupo est\u00e1 bien formado y se distribuye. \u2019$error_message ||= $tobj  -\u003e  validate($new_value)\u2019 toma el propio mensaje de fallo de una restricci\u00f3n de tipo, que renderiza el valor rechazado a trav\u00e9s de un dumper parcial en formato de corchetes y comas (Devel::PartialDump cuando Moose puede cargarlo, el propio dumper de Type::Tiny siempre), por lo que un campo con \u2019apply =\u003e [ Str ]\u2019 al que se le da un par\u00e1metro enviado m\u00e1s de una vez, que llega como un array, obtiene \u2019Reference [\u201ca\u201d,\u201cb\u201d] did not pass type constraint \u201cStr\u201d\u2019 como su plantilla, de una solicitud que no lleva ning\u00fan car\u00e1cter de corchete propio. Una excepci\u00f3n de coerci\u00f3n o transformaci\u00f3n lo alcanza de la misma manera. M\u00e1s all\u00e1 de eso, un validador cuyo mensaje contiene el valor del campo coloca ese valor directamente en la plantilla, y add_error reemplaza la lista de mensajes con el contenido de un primer argumento arrayref (\u2019@message = @{$message[0]} if ref $message[0] eq \u2019ARRAY\u2019\u2019), por lo que un valor que llega como un array tambi\u00e9n llena las ranuras de argumentos de la misma solicitud.\n\nUn grupo mal formado como \u2019[0]\u2019 hace que la compilaci\u00f3n falle, y HTML::FormHandler::I18N::maketext y add_error cada uno lo vuelve a lanzar como un \u2019die\u2019, por lo que process() lanza una excepci\u00f3n. Un grupo bien formado que nombra a sprintf llega a CORE::sprintf con un ancho de campo elegido por el atacante. Cualquier llamador que aplique una restricci\u00f3n de tipo o una transformaci\u00f3n a un campo no confiable, o cuyo validador pase un valor de campo no confiable a add_error, puede ser forzado a lanzar una excepci\u00f3n no manejada fuera de process(), o a asignar una cantidad arbitraria de memoria en una solicitud, y una aplicaci\u00f3n cuya subclase de gestor de idioma define m\u00e9todos p\u00fablicos con efectos secundarios los hace invocables con argumentos elegidos por el atacante. El mensaje de restricci\u00f3n de tipo volcado est\u00e1 limitado a la excepci\u00f3n, porque ambos dumpers citan elementos no num\u00e9ricos, por lo que la ranura del m\u00e9todo nunca es un nombre elegido por el atacante. Los mensajes incorporados pasan plantillas fijas con el valor en una ranura de argumento, donde permanece inerte, y los tipos de campo incorporados adjuntan devoluciones de llamada de mensajes expl\u00edcitas, por lo que ninguno se ve afectado."
    }
  ],
  "id": "CVE-2022-4993",
  "lastModified": "2026-11-10T12:10:00.177",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-4993",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-14T11:14:18.115170Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-13T17:17:17.780",
  "references": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "url": "https://github.com/gshank/html-formhandler/commit/8a204d0e64d8b30f37b19604af9b979413dffd41.patch"
    },
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "url": "https://github.com/gshank/html-formhandler/pull/159"
    },
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "url": "https://metacpan.org/release/ABRAXXA/HTML-FormHandler-0.410001/changes"
    },
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "url": "https://metacpan.org/release/GSHANK/HTML-FormHandler-0.40068/source/lib/HTML/FormHandler/Field.pm#L861-876"
    },
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "url": "https://metacpan.org/release/GSHANK/HTML-FormHandler-0.40068/source/lib/HTML/FormHandler/I18N/en_us.pm#L9-11"
    },
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "url": "https://metacpan.org/release/GSHANK/HTML-FormHandler-0.40068/source/lib/HTML/FormHandler/Validate.pm#L161-261"
    },
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-6329"
    }
  ],
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-470"
        },
        {
          "lang": "en",
          "value": "CWE-1336"
        }
      ],
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "type": "Secondary"
    }
  ]
}

GHSA-7P5W-9CXG-WCF3

Vulnerability from github – Published: 2026-08-13 18:31 – Updated: 2026-09-08 21:32

Details

HTML::FormHandler versions through 0.40068 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template.

add_error hands its first argument to the language handle as the Locale::Maketext message key, and the default handle's lexicon sets _AUTO, so a string that is not a lexicon entry is compiled as a bracket notation template instead of being looked up. In a bracket group the first token names a method called on the language handle and the remaining tokens are its arguments.

Three kinds of text the library did not author reach that position. _apply_actions installs a $SIG{__WARN__} handler that stores the warning text in $error_message, and a captured warning survives a successful action, so a field carrying a numeric transform turns Argument "[sprintf,%50000000d,0]" isn't numeric into the template; a warning quotes the submitted value verbatim, so the group is well formed and dispatches. $error_message ||= $tobj->validate($new_value) takes a type constraint's own failure message, which renders the rejected value through a partial dumper in bracket and comma form (Devel::PartialDump when Moose can load it, Type::Tiny's own dumper always), so a field with apply => [ Str ] given a parameter sent more than once, which arrives as an array, gets Reference ["a","b"] did not pass type constraint "Str" as its template, from a request that carries no bracket character of its own. A coercion or transform exception reaches it the same way. Beyond those, a validator whose message contains the field value puts that value in the template directly, and add_error replaces the message list with the contents of an arrayref first argument (@message = @{$message[0]} if ref $message[0] eq 'ARRAY'), so a value arriving as an array fills the argument slots from the same request as well.

A malformed group such as [0] makes the compile croak, and HTML::FormHandler::I18N::maketext and add_error each re-raise that as a die, so process() throws. A well formed group naming sprintf reaches CORE::sprintf with an attacker chosen field width. Any caller that applies a type constraint or a transform to an untrusted field, or whose validator passes an untrusted field value to add_error, can be made to throw an unhandled exception out of process(), or to allocate an arbitrary amount of memory in one request, and an application whose language handle subclass defines side effecting public methods makes those callable with attacker chosen arguments. The dumped type constraint message is bounded to the exception, because both dumpers quote non-numeric elements so the method slot is never an attacker chosen name. The built-in messages pass fixed templates with the value in an argument slot, where it stays inert, and the built-in field types attach explicit message callbacks, so neither is affected.

Severity

9.1 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-4993"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-470"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-13T17:17:17Z",
    "severity": "CRITICAL"
  },
  "details": "HTML::FormHandler versions through 0.40068 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template.\n\nadd_error hands its first argument to the language handle as the Locale::Maketext message key, and the default handle\u0027s lexicon sets `_AUTO`, so a string that is not a lexicon entry is compiled as a bracket notation template instead of being looked up. In a bracket group the first token names a method called on the language handle and the remaining tokens are its arguments.\n\nThree kinds of text the library did not author reach that position. _apply_actions installs a `$SIG{__WARN__}` handler that stores the warning text in `$error_message`, and a captured warning survives a successful action, so a field carrying a numeric transform turns `Argument \"[sprintf,%50000000d,0]\" isn\u0027t numeric` into the template; a warning quotes the submitted value verbatim, so the group is well formed and dispatches. `$error_message ||= $tobj-\u003evalidate($new_value)` takes a type constraint\u0027s own failure message, which renders the rejected value through a partial dumper in bracket and comma form (Devel::PartialDump when Moose can load it, Type::Tiny\u0027s own dumper always), so a field with `apply =\u003e [ Str ]` given a parameter sent more than once, which arrives as an array, gets `Reference [\"a\",\"b\"] did not pass type constraint \"Str\"` as its template, from a request that carries no bracket character of its own. A coercion or transform exception reaches it the same way. Beyond those, a validator whose message contains the field value puts that value in the template directly, and add_error replaces the message list with the contents of an arrayref first argument (`@message = @{$message[0]} if ref $message[0] eq \u0027ARRAY\u0027`), so a value arriving as an array fills the argument slots from the same request as well.\n\nA malformed group such as `[0]` makes the compile croak, and HTML::FormHandler::I18N::maketext and add_error each re-raise that as a die, so process() throws. A well formed group naming sprintf reaches CORE::sprintf with an attacker chosen field width. Any caller that applies a type constraint or a transform to an untrusted field, or whose validator passes an untrusted field value to add_error, can be made to throw an unhandled exception out of process(), or to allocate an arbitrary amount of memory in one request, and an application whose language handle subclass defines side effecting public methods makes those callable with attacker chosen arguments. The dumped type constraint message is bounded to the exception, because both dumpers quote non-numeric elements so the method slot is never an attacker chosen name. The built-in messages pass fixed templates with the value in an argument slot, where it stays inert, and the built-in field types attach explicit message callbacks, so neither is affected.",
  "id": "GHSA-7p5w-9cxg-wcf3",
  "modified": "2026-09-08T21:32:32Z",
  "published": "2026-08-13T18:31:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4993"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gshank/html-formhandler/pull/159"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gshank/html-formhandler/commit/8a204d0e64d8b30f37b19604af9b979413dffd41.patch"
    },
    {
      "type": "WEB",
      "url": "https://metacpan.org/release/ABRAXXA/HTML-FormHandler-0.410001/changes"
    },
    {
      "type": "WEB",
      "url": "https://metacpan.org/release/GSHANK/HTML-FormHandler-0.40068/source/lib/HTML/FormHandler/Field.pm#L861-876"
    },
    {
      "type": "WEB",
      "url": "https://metacpan.org/release/GSHANK/HTML-FormHandler-0.40068/source/lib/HTML/FormHandler/I18N/en_us.pm#L9-11"
    },
    {
      "type": "WEB",
      "url": "https://metacpan.org/release/GSHANK/HTML-FormHandler-0.40068/source/lib/HTML/FormHandler/Validate.pm#L161-261"
    },
    {
      "type": "WEB",
      "url": "https://security.metacpan.org/patches/H/HTML-FormHandler/0.40068/CVE-2022-4993-r2.patch"
    },
    {
      "type": "WEB",
      "url": "https://www.cve.org/CVERecord?id=CVE-2012-6329"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

OPENSUSE-SU-2026:11745-1

Vulnerability from csaf_opensuse - Published: 2026-09-10 00:00 - Updated: 2026-09-17 17:23

Summary

perl-HTML-FormHandler-0.410.2-1.1 on GA media

Severity

Moderate

Scope

5 vulnerabilities in this advisory, including CVE-2022-4993.

CVE-2022-4993

Recommended: 4 products

Open the full advisory

UBUNTU-CVE-2022-4993 (CVE-2022-4993)

Vulnerability from osv_ubuntu – Published: 2026-08-13 17:17 – Updated: 2026-10-17 09:10 – Source website

Details

HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template. add_error hands its first argument to the language handle as the Locale::Maketext message key, and the default handle's lexicon sets _AUTO, so a string that is not a lexicon entry is compiled as a bracket notation template instead of being looked up. In a bracket group the first token names a method called on the language handle and the remaining tokens are its arguments. Three kinds of text the library did not author reach that position. _apply_actions installs a $SIG{__WARN__} handler that stores the warning text in $error_message, and a captured warning survives a successful action, so a field carrying a numeric transform turns Argument "[sprintf,%50000000d,0]" isn't numeric into the template; a warning quotes the submitted value verbatim, so the group is well formed and dispatches. $error_message ||= $tobj->validate($new_value) takes a type constraint's own failure message, which renders the rejected value through a partial dumper in bracket and comma form (Devel::PartialDump when Moose can load it, Type::Tiny's own dumper always), so a field with apply => [ Str ] given a parameter sent more than once, which arrives as an array, gets Reference ["a","b"] did not pass type constraint "Str" as its template, from a request that carries no bracket character of its own. A coercion or transform exception reaches it the same way. Beyond those, a validator whose message contains the field value puts that value in the template directly, and add_error replaces the message list with the contents of an arrayref first argument (@message = @{$message[0]} if ref $message[0] eq 'ARRAY'), so a value arriving as an array fills the argument slots from the same request as well. A malformed group such as [0] makes the compile croak, and HTML::FormHandler::I18N::maketext and add_error each re-raise that as a die, so process() throws. A well formed group naming sprintf reaches CORE::sprintf with an attacker chosen field width. Any caller that applies a type constraint or a transform to an untrusted field, or whose validator passes an untrusted field value to add_error, can be made to throw an unhandled exception out of process(), or to allocate an arbitrary amount of memory in one request, and an application whose language handle subclass defines side effecting public methods makes those callable with attacker chosen arguments. The dumped type constraint message is bounded to the exception, because both dumpers quote non-numeric elements so the method slot is never an attacker chosen name. The built-in messages pass fixed templates with the value in an argument slot, where it stays inert, and the built-in field types attach explicit message callbacks, so neither is affected.

Severity

9.1 (Critical)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2022-4993	REPORT
	https://www.cve.org/CVERecord?id=CVE-2022-4993	REPORT
	https://lists.security.metacpan.org/cve-announce/…	REPORT
	https://security.metacpan.org/patches/H/HTML-Form…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libhtml-formhandler-perl",
            "binary_version": "0.40064-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "libhtml-formhandler-perl",
        "purl": "pkg:deb/ubuntu/libhtml-formhandler-perl@0.40064-1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.40057-1",
        "0.40064-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libhtml-formhandler-perl",
            "binary_version": "0.40068-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "libhtml-formhandler-perl",
        "purl": "pkg:deb/ubuntu/libhtml-formhandler-perl@0.40068-1?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.40067-1",
        "0.40068-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libhtml-formhandler-perl",
            "binary_version": "0.40068-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "libhtml-formhandler-perl",
        "purl": "pkg:deb/ubuntu/libhtml-formhandler-perl@0.40068-1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.40068-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libhtml-formhandler-perl",
            "binary_version": "0.40068-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "libhtml-formhandler-perl",
        "purl": "pkg:deb/ubuntu/libhtml-formhandler-perl@0.40068-1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.40068-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libhtml-formhandler-perl",
            "binary_version": "0.40068-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "libhtml-formhandler-perl",
        "purl": "pkg:deb/ubuntu/libhtml-formhandler-perl@0.40068-2?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.40068-2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libhtml-formhandler-perl",
            "binary_version": "0.40068-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.10",
        "name": "libhtml-formhandler-perl",
        "purl": "pkg:deb/ubuntu/libhtml-formhandler-perl@0.40068-3?arch=source\u0026distro=stonking"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.40068-2",
        "0.40068-3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libhtml-formhandler-perl",
            "binary_version": "0.40068-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "libhtml-formhandler-perl",
        "purl": "pkg:deb/ubuntu/libhtml-formhandler-perl@0.40068-2?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.40068-2"
      ]
    }
  ],
  "aliases": [],
  "details": "HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template. add_error hands its first argument to the language handle as the Locale::Maketext message key, and the default handle\u0027s lexicon sets `_AUTO`, so a string that is not a lexicon entry is compiled as a bracket notation template instead of being looked up. In a bracket group the first token names a method called on the language handle and the remaining tokens are its arguments. Three kinds of text the library did not author reach that position. _apply_actions installs a `$SIG{__WARN__}` handler that stores the warning text in `$error_message`, and a captured warning survives a successful action, so a field carrying a numeric transform turns `Argument \"[sprintf,%50000000d,0]\" isn\u0027t numeric` into the template; a warning quotes the submitted value verbatim, so the group is well formed and dispatches. `$error_message ||= $tobj-\u003evalidate($new_value)` takes a type constraint\u0027s own failure message, which renders the rejected value through a partial dumper in bracket and comma form (Devel::PartialDump when Moose can load it, Type::Tiny\u0027s own dumper always), so a field with `apply =\u003e [ Str ]` given a parameter sent more than once, which arrives as an array, gets `Reference [\"a\",\"b\"] did not pass type constraint \"Str\"` as its template, from a request that carries no bracket character of its own. A coercion or transform exception reaches it the same way. Beyond those, a validator whose message contains the field value puts that value in the template directly, and add_error replaces the message list with the contents of an arrayref first argument (`@message = @{$message[0]} if ref $message[0] eq \u0027ARRAY\u0027`), so a value arriving as an array fills the argument slots from the same request as well. A malformed group such as `[0]` makes the compile croak, and HTML::FormHandler::I18N::maketext and add_error each re-raise that as a die, so process() throws. A well formed group naming sprintf reaches CORE::sprintf with an attacker chosen field width. Any caller that applies a type constraint or a transform to an untrusted field, or whose validator passes an untrusted field value to add_error, can be made to throw an unhandled exception out of process(), or to allocate an arbitrary amount of memory in one request, and an application whose language handle subclass defines side effecting public methods makes those callable with attacker chosen arguments. The dumped type constraint message is bounded to the exception, because both dumpers quote non-numeric elements so the method slot is never an attacker chosen name. The built-in messages pass fixed templates with the value in an argument slot, where it stays inert, and the built-in field types attach explicit message callbacks, so neither is affected.",
  "id": "UBUNTU-CVE-2022-4993",
  "modified": "2026-10-17T09:10:34Z",
  "published": "2026-08-13T17:17:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-4993"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-4993"
    },
    {
      "type": "REPORT",
      "url": "https://lists.security.metacpan.org/cve-announce/msg/42659947/"
    },
    {
      "type": "REPORT",
      "url": "https://security.metacpan.org/patches/H/HTML-FormHandler/0.40068/CVE-2022-4993-r2.patch"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2022-4993"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2022-4993 (GCVE-0-2022-4993)

FKIE_CVE-2022-4993

GHSA-7P5W-9CXG-WCF3

OPENSUSE-SU-2026:11745-1

UBUNTU-CVE-2022-4993 (CVE-2022-4993)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour