[ CVE-2026-120631 · Published 4 Nov 2026 ]
Vulnerability
Not scored yet
EPSS <1%No fix listed yet
[ Description ]Official description
CGI::Cookie versions from 4.67 before 5.00 for Perl allow denial of service via the client cookie expires value used as a regex in parse. CGI's cookie method reads the Cookie request header through parse, which interpolates the header's expires value unescaped into the substitution pattern that removes it from the cookie string. A client can make the request die with an invalid pattern, or tie up the process with one that backtracks catastrophically.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.