CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI.

The before_dispatch hook installed by startup() removes PATH_INFO from the end of the request URI with a substitution that interpolates PATH_INFO unquoted. Under CGI, FastCGI and PSGI both values come from the request, so the client chooses both the pattern and the string it is matched against.

A short unauthenticated request with a backreference in the path backtracks exponentially and can keep a worker process busy for minutes.

Üreticinin çözüm notu (İngilizce)

Upgrade to CallBackery 0.62.0 or later.

Etkilenen sürümler1 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• metacpan.org/release/OETIKER/CallBackery-0.62.0/changes Diğer

Kayıt geçmişi

1. 6 Kas 2026 20:00CVSS puanı değişti: – → 7.5
2. 30 Eki 2026 16:11Yayımlandı

İlgili açıklar

• 7,5 CVE-2026-118986CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand()
• 5,3 CVE-2026-118987CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header
• 5,5 CVE-2026-118990CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup
• 7,5 CVE-2026-118991CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key
• 8,4 CVE-2026-118992CallBackery (Perl) yapılandırma yedeği geri yüklemede işletim sistemi komutu çalıştırma
• 9,8 CVE-2026-118994CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name