Bug 2566607 (CVE-2026-120645)

Summary: CVE-2026-120645 perl-cgi: perl-cgi: Denial of Service via unescaped regular expression injection in scrolling_list
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in perl-cgi. When rendering option groups using the scrolling_list function, user-supplied input from request parameters is directly inserted into regular expression search patterns without proper escaping. A remote attacker can exploit this vulnerability by submitting crafted input containing invalid patterns or patterns designed to cause excessive processing. This can cause the application process to terminate or become unresponsive, resulting in a Denial of Service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-03 23:52:15 UTC 
CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrolling_list.

When rendering option groups, scrolling_list marks the selected options by interpolating each selected value, by default taken from the request parameters, unescaped into a substitution pattern.

A client can make the request die with an invalid pattern, or tie up the process with one that backtracks heavily.