Perl CGI before 5.00: 20 CVEs for denial of service and trusted host headers

What happened and what to do

The oss-sec advisory, published by Stig Palmquist on November 3, 2026, lists 20 CVEs in the Perl CGI module before version 5.00. Cited items include denial of service through the cookie expiration value, used as a regular expression in CGI::Cookie from version 4.67, CPU exhaustion caused by a backtracking regular expression when parsing XForms multipart/related Content-Type, and trust in the client's X-Forwarded-Host header in the url, self_url, virtual_host and virtual_port methods.

For a company still running Perl applications with CGI, the first step is to identify which systems depend on these versions, including transitive dependencies, and plan the upgrade to 5.00 or later. While the upgrade is pending, it can limit cookie and multipart body sizes at the reverse proxy, reject untrusted X-Forwarded-Host headers, and monitor CPU spikes and response times per route. These are routine engineering measures and do not require AI.

How the consultancy can help

Diagnosis of the Perl application estate and affected CGI dependencies, prioritized by public exposure. Then design and implementation of temporary proxy mitigations and CPU and latency monitoring, with an upgrade plan to fixed versions, run on the client's infrastructure.

Next step

If your company maintains Perl applications with CGI, send a short description of your environment and exposed systems. We will reply with a scoped diagnosis and implementation proposal.