UNKNOWN NVD

CVE-2026-118993

CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI. The

CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI. The before_dispatch hook installed by startup() removes PATH_INFO from the end of the request URI with a substitution that interpolates PATH_INFO unquoted. Under CGI, FastCGI and PSGI both values come from the request, so the client chooses both the pattern and the string it is matched against. A short unauthenticated request with a backreference in the path backtracks exponentially and can keep a worker process busy for minutes.

References

https://metacpan.org/release/OETIKER/CallBackery-0.62.0/changes

Published: 2026-10-30 · Source: NVD · Feed updated: 2026-10-30

This unknown severity vulnerability was published on 2026-10-30 via NVD.

vulnfeed aggregates 17475 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.