---
id: CVE-2026-118993
title: >-
  CallBackery versions before 0.62.0 for Perl allow denial of service via the
  request path interpolated as a regular expression under CGI, FastCGI and PSGI
summary: >-
  CallBackery versions before 0.62.0 for Perl allow denial of service via the
  request path interpolated as a regular expression under CGI, FastCGI and PSGI.


  The before_dispatch hook installed by startup() removes PATH_INFO from the end
  of…
severity: none
cwe:
  - CWE-1333
product: CallBackery
affected:
  - CallBackery < 0.62.0
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T13:11:14.458Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118993'
references:
  - url: 'https://metacpan.org/release/OETIKER/CallBackery-0.62.0/changes'
tags:
  - cve.org
epss: 0.00158
epssPercentile: 0.04962
ingestedAt: '2026-11-05T16:07:30.234Z'
---

## Overview

CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI.

The before_dispatch hook installed by startup() removes PATH_INFO from the end of the request URI with a substitution that interpolates PATH_INFO unquoted. Under CGI, FastCGI and PSGI both values come from the request, so the client chooses both the pattern and the string it is matched against.

A short unauthenticated request with a backreference in the path backtracks exponentially and can keep a worker process busy for minutes.

## Affected

- `CallBackery < 0.62.0`

## Remediation

Upgrade to CallBackery 0.62.0 or later.