CVE-2026-120651 | CGI up to 4.x Upload lib/CGI.pm read_postdata_putdata DISABLE_UPLOADS infinite loop

November 4, 2026 Yanac

A vulnerability, which was classified as problematic, was found in CGI up to 4.x. Impacted is the function read_postdata_putdata of the file lib/CGI.pm of the component Upload. The manipulation of the argument DISABLE_UPLOADS results in infinite loop.

This vulnerability was named CVE-2026-120651. The attack may be performed from remote. There is no available exploit.

You should upgrade the affected component.VulDB Recent EntriesRead More