{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for perl-CGI is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "CGI.pm is a stable, complete and mature solution for processing and preparing HTTP requests and responses. Major features including processing form submissions, file uploads, reading and writing cookies, query string generation and manipulation, and processing and preparing HTTP headers. Some HTML generation utilities are included as well.  CGI.pm performs very well in in a vanilla CGI.pm environment and also comes with built-in support for mod_perl and mod_perl2 as well as FastCGI.\n\nSecurity Fix(es):\n\n* perl-cgi: perl-cgi: Denial of Service via unenforced request and upload limits (CVE-2026-120650)\n\n* perl-cgi: perl-cgi: arbitrary file write via unsanitized upload filenames (CVE-2026-120641)\n\n* perl-cgi: perl-cgi: Security feature bypass via untainted request parameters (CVE-2026-120642)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:99849",
        "url": "https://access.redhat.com/errata/RHSA-2026:99849"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2566595",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2566595"
      },
      {
        "category": "external",
        "summary": "2566598",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2566598"
      },
      {
        "category": "external",
        "summary": "2566605",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2566605"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_99849.json"
      }
    ],
    "title": "Red Hat Security Advisory: perl-CGI security update",
    "tracking": {
      "current_release_date": "2026-11-13T00:05:45+00:00",
      "generator": {
        "date": "2026-11-13T00:05:45+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.6"
        }
      },
      "id": "RHSA-2026:99849",
      "initial_release_date": "2026-11-12T20:49:56+00:00",
      "revision_history": [
        {
          "date": "2026-11-12T20:49:56+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-11-12T20:49:56+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-13T00:05:45+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                  "product_id": "AppStream-8.10.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-CGI-0:4.38-3.el8_10.src",
                "product": {
                  "name": "perl-CGI-0:4.38-3.el8_10.src",
                  "product_id": "perl-CGI-0:4.38-3.el8_10.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/perl-CGI@4.38-3.el8_10?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-CGI-0:4.38-3.el8_10.noarch",
                "product": {
                  "name": "perl-CGI-0:4.38-3.el8_10.noarch",
                  "product_id": "perl-CGI-0:4.38-3.el8_10.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/perl-CGI@4.38-3.el8_10?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-CGI-0:4.38-3.el8_10.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:perl-CGI-0:4.38-3.el8_10.noarch"
        },
        "product_reference": "perl-CGI-0:4.38-3.el8_10.noarch",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-CGI-0:4.38-3.el8_10.src as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:perl-CGI-0:4.38-3.el8_10.src"
        },
        "product_reference": "perl-CGI-0:4.38-3.el8_10.src",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-120641",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory"
      },
      "discovery_date": "2026-11-03T23:51:20.995186+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2566598"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in perl-cgi. The module returns client-supplied upload filenames without sanitizing directory traversal sequences or path separators. A remote attacker can exploit this flaw by submitting a file upload with a crafted filename, potentially causing the host application to write files outside the intended destination directory.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "perl-cgi: perl-cgi: arbitrary file write via unsanitized upload filenames",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important severity because unauthenticated remote attackers can overwrite arbitrary files with the privileges of the web server process when applications accept file uploads. In Red Hat Enterprise Linux environments, perl-CGI functions as a library rather than an exposed standalone service, meaning exposure is limited to scripts configured to handle multipart form data. Successful attacks require downstream code to directly persist files using the untrusted client-provided filename without independent sanitization or unique name generation.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:perl-CGI-0:4.38-3.el8_10.noarch",
          "AppStream-8.10.0.Z.MAIN.EUS:perl-CGI-0:4.38-3.el8_10.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-120641"
        },
        {
          "category": "external",
          "summary": "RHBZ#2566598",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2566598"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-120641",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-120641"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-120641",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120641"
        },
        {
          "category": "external",
          "summary": "https://github.com/leejo/CGI.pm/commit/5379eb18e87b7f985613f5c4f7bae94478a4fa2f.patch",
          "url": "https://github.com/leejo/CGI.pm/commit/5379eb18e87b7f985613f5c4f7bae94478a4fa2f.patch"
        },
        {
          "category": "external",
          "summary": "https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm",
          "url": "https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm"
        },
        {
          "category": "external",
          "summary": "https://metacpan.org/release/LEEJO/CGI-5.00/changes",
          "url": "https://metacpan.org/release/LEEJO/CGI-5.00/changes"
        }
      ],
      "release_date": "2026-11-03T23:40:36.961000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-12T20:49:56+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:perl-CGI-0:4.38-3.el8_10.noarch",
            "AppStream-8.10.0.Z.MAIN.EUS:perl-CGI-0:4.38-3.el8_10.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:99849"
        },
        {
          "category": "workaround",
          "details": "--- CME Mitigation Guidance (2026-11-04) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to sanitize client-supplied upload filenames or canonicalize destination paths before saving files in applications using CGI.pm: upgrade to CGI 5.00+ (or the fixed Perl Cgi builds), which strip control characters and directory segments separated by forward slashes and backslashes from upload filenames, defaulting to \u0027upload\u0027 if no usable name remains, closing all 3 injection vectors (multipart Content-Disposition filenames with relative directory traversal sequences, multipart Content-Disposition filenames with absolute path segments, multipart Content-Disposition filenames with Windows path separators). Until patched, this is a concern on Applications on any platform using CGI.pm to handle multipart/form-data file uploads that save files under the returned filename, so Implement independent path sanitization or canonicalization in application code to ensure destination paths remain strictly confined to designated upload directories before saving files. As a compensating measure, Inspect HTTP multipart/form-data payloads with a web application firewall to detect and block traversal sequences inside the Content-Disposition filename parameter, Log kernel-level filesystem write events using auditd to provide forensic visibility when files are created outside the intended upload directory, Monitor file-system write operations with Falco or eBPF runtime security to alert on unexpected file creation outside standard upload directories by the web process, and Deploy file integrity monitoring such as AIDE to detect unauthorized creation or modification of critical system files resulting from traversal writes. These controls limit blast radius and contain exploitation, but they do not fix the underlying path traversal vulnerability \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1301 Path Traversal Prevention (Canonicalization) (high)",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:perl-CGI-0:4.38-3.el8_10.noarch",
            "AppStream-8.10.0.Z.MAIN.EUS:perl-CGI-0:4.38-3.el8_10.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:perl-CGI-0:4.38-3.el8_10.noarch",
            "AppStream-8.10.0.Z.MAIN.EUS:perl-CGI-0:4.38-3.el8_10.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "perl-cgi: perl-cgi: arbitrary file write via unsanitized upload filenames"
    },
    {
      "cve": "CVE-2026-120642",
      "cwe": {
        "id": "CWE-501",
        "name": "Trust Boundary Violation"
      },
      "discovery_date": "2026-11-03T23:51:45.842543+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2566605"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in perl-cgi. When running under Perl\u0027s taint mode\u2014a security feature that prevents untrusted data from being used in sensitive operations\u2014the module returns several request-derived values without taint flags. A remote attacker could exploit this vulnerability by submitting crafted request parameters to bypass taint checks, potentially allowing unvalidated data to reach sensitive operations in applications that rely on taint verification.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "perl-cgi: perl-cgi: Security feature bypass via untainted request parameters",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat has evaluated this vulnerability as Important because it compromises Perl\u0027s core taint security boundary in environments where perl-CGI is deployed to handle untrusted web requests. While exploitation depends on scripts explicitly enforcing taint checks and passing affected parameter fields into privileged execution paths, this failure allows unauthenticated remote attackers to bypass trust restrictions. The perl-CGI component is not active by default in Red Hat Enterprise Linux and is limited to systems where legacy CGI scripts are configured.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:perl-CGI-0:4.38-3.el8_10.noarch",
          "AppStream-8.10.0.Z.MAIN.EUS:perl-CGI-0:4.38-3.el8_10.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-120642"
        },
        {
          "category": "external",
          "summary": "RHBZ#2566605",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2566605"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-120642",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-120642"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-120642",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120642"
        },
        {
          "category": "external",
          "summary": "https://github.com/leejo/CGI.pm/commit/6ae50ce84073b8f68a6e3750479de70d5b8f2dcf.patch",
          "url": "https://github.com/leejo/CGI.pm/commit/6ae50ce84073b8f68a6e3750479de70d5b8f2dcf.patch"
        },
        {
          "category": "external",
          "summary": "https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm",
          "url": "https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm"
        },
        {
          "category": "external",
          "summary": "https://metacpan.org/release/LEEJO/CGI-5.00/changes",
          "url": "https://metacpan.org/release/LEEJO/CGI-5.00/changes"
        }
      ],
      "release_date": "2026-11-03T23:40:44.224000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-12T20:49:56+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:perl-CGI-0:4.38-3.el8_10.noarch",
            "AppStream-8.10.0.Z.MAIN.EUS:perl-CGI-0:4.38-3.el8_10.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:99849"
        },
        {
          "category": "workaround",
          "details": "--- CME Mitigation Guidance (2026-11-04) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce strict allowlist validation on all CGI request parameters and upload metadata before passing them into sensitive operations: upgrade to CGI 5.00 (or the fixed Perl Cgi builds), which append a tainted substring to request-derived hash keys and regex capture values before returning them, closing all 5 injection vectors (crafted upload filenames, crafted uploadInfo header values, crafted path_info or script_name values, crafted Accept header values, crafted url_param or cookie names). Until patched, this is a concern on applications running under Perl taint mode (-T) that rely on taint verification for CGI request metadata and parameter keys, so audit and explicitly untaint or validate all request metadata, file upload headers, and parameter names before passing them to sensitive functions like open or system. As a compensating measure, use direct process execution without shell invocation when passing CGI-derived values to process sinks, validate and sanitize upload filenames and uploadInfo headers against strict extension and content allowlists before processing, run SELinux in enforcing mode to confine the web server and CGI process domain, and apply enforcing AppArmor profiles to restrict file access and process execution for CGI scripts. These controls limit blast radius and contain exploitation, but they do not fix the underlying taint-check bypass defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1315 Allowlist-Preferred Input Validation (Deny-by-Default Filtering) (high)",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:perl-CGI-0:4.38-3.el8_10.noarch",
            "AppStream-8.10.0.Z.MAIN.EUS:perl-CGI-0:4.38-3.el8_10.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:perl-CGI-0:4.38-3.el8_10.noarch",
            "AppStream-8.10.0.Z.MAIN.EUS:perl-CGI-0:4.38-3.el8_10.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "perl-cgi: perl-cgi: Security feature bypass via untainted request parameters"
    },
    {
      "cve": "CVE-2026-120650",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-11-03T23:51:10.115786+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2566595"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in perl-cgi. A remote attacker can trigger a Denial of Service (DoS) through excessive memory, processor, and disk space consumption by sending specially crafted HTTP requests. Due to missing or unenforced limits on request sizes, parameters, and file uploads, the module processes oversized or chunked payloads directly into memory without restriction, leading to system resource exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "perl-cgi: perl-cgi: Denial of Service via unenforced request and upload limits",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important severity because it allows unauthenticated remote attackers to cause complete service unavailability without requiring privileges or user interaction. In Red Hat Enterprise Linux environments hosting Perl-based web applications, scripts parsing inbound HTTP traffic with this module fail to enforce proper boundaries on parameters and multipart payloads. Consequently, untrusted network traffic can rapidly deplete memory, storage, and processing capacity on production systems.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:perl-CGI-0:4.38-3.el8_10.noarch",
          "AppStream-8.10.0.Z.MAIN.EUS:perl-CGI-0:4.38-3.el8_10.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-120650"
        },
        {
          "category": "external",
          "summary": "RHBZ#2566595",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2566595"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-120650",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-120650"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-120650",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120650"
        },
        {
          "category": "external",
          "summary": "https://github.com/leejo/CGI.pm/commit/17b838dc14d2b82ae6c7e76f66ec2c3f3b08038b.patch",
          "url": "https://github.com/leejo/CGI.pm/commit/17b838dc14d2b82ae6c7e76f66ec2c3f3b08038b.patch"
        },
        {
          "category": "external",
          "summary": "https://github.com/leejo/CGI.pm/commit/277baeb74fde7bce975a7bd0a1f98dcf1b9b2050.patch",
          "url": "https://github.com/leejo/CGI.pm/commit/277baeb74fde7bce975a7bd0a1f98dcf1b9b2050.patch"
        },
        {
          "category": "external",
          "summary": "https://github.com/leejo/CGI.pm/commit/8940a74e53a41563f72813b45f99cceaaa4c92e8.patch",
          "url": "https://github.com/leejo/CGI.pm/commit/8940a74e53a41563f72813b45f99cceaaa4c92e8.patch"
        },
        {
          "category": "external",
          "summary": "https://github.com/leejo/CGI.pm/commit/f3febefe63fe3881d8c3ae10fa83ca8ec950b959.patch",
          "url": "https://github.com/leejo/CGI.pm/commit/f3febefe63fe3881d8c3ae10fa83ca8ec950b959.patch"
        },
        {
          "category": "external",
          "summary": "https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm",
          "url": "https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm"
        },
        {
          "category": "external",
          "summary": "https://metacpan.org/release/LEEJO/CGI-5.00/changes",
          "url": "https://metacpan.org/release/LEEJO/CGI-5.00/changes"
        }
      ],
      "release_date": "2026-11-03T23:41:14.474000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-12T20:49:56+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:perl-CGI-0:4.38-3.el8_10.noarch",
            "AppStream-8.10.0.Z.MAIN.EUS:perl-CGI-0:4.38-3.el8_10.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:99849"
        },
        {
          "category": "workaround",
          "details": "--- CME Mitigation Guidance (2026-11-04) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to enforce strict upper bounds on incoming request body sizes, parameter counts, boundary lengths, and file uploads within the web server or proxy layer before reaching CGI scripts: upgrade to CGI 5.00 (or the fixed Perl Cgi builds), which enforce a default 128MB POST_MAX dynamically during reads, process postdata in bounded chunks, cap initial boundary lines at 1KB, and reject requests exceeding 10,000 parameters or 1,000 uploads with HTTP 413, closing all 5 injection vectors (monolithic in-memory slurping of large POST, PUT, or PATCH request bodies, unbounded multipart boundary line read lacking a boundary parameter, chunked multipart payloads bypassing static CONTENT_LENGTH checks, excessive parameter counts in URL queries or form bodies, excessive multipart file uploads exhausting file descriptors and disk space). Until patched, this is a concern on applications accepting HTTP POST, PUT, PATCH, or multipart requests using perl-CGI prior to version 5.00, so restrict maximum allowed HTTP body sizes, parameter quantities, and file upload counts at upstream reverse proxies or web servers, and reject requests lacking a boundary parameter on multipart content types. As a compensating measure, monitor cgroup memory pressure via memory.events and PSI to detect anomalous memory surges and imminent out-of-memory conditions, constrain process address space and maximum file sizes using ulimit or prlimit to contain denial of service, and enforce hard cgroups v2 memory and CPU resource bounds on the Perl application process to limit blast radius. These controls limit blast radius and contain exploitation, but they do not fix the underlying unenforced request and upload limits defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:perl-CGI-0:4.38-3.el8_10.noarch",
            "AppStream-8.10.0.Z.MAIN.EUS:perl-CGI-0:4.38-3.el8_10.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:perl-CGI-0:4.38-3.el8_10.noarch",
            "AppStream-8.10.0.Z.MAIN.EUS:perl-CGI-0:4.38-3.el8_10.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "perl-cgi: perl-cgi: Denial of Service via unenforced request and upload limits"
    }
  ]
}