---
id: CVE-2026-120645
title: >-
  CGI versions before 5.00 for Perl allow denial of service via submitted values
  used as a regex for optgroup selection in scrolling_list
summary: >-
  CGI versions before 5.00 for Perl allow denial of service via submitted values
  used as a regex for optgroup selection in scrolling_list.


  When rendering option groups, scrolling_list marks the selected options by
  interpolating each selec…
severity: none
cwe:
  - CWE-1333
  - CWE-625
product: CGI
affected:
  - CGI < 5.00
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T23:40:54.754Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120645'
references:
  - url: 'https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm'
  - url: 'https://metacpan.org/release/LEEJO/CGI-5.00/changes'
  - url: >-
      https://github.com/leejo/CGI.pm/commit/824956fbb0c4eb77044ba2dc9180a30df12cb309.patch
tags:
  - cve.org
epss: 0.00389
epssPercentile: 0.33129
ingestedAt: '2026-11-05T20:33:06.617Z'
---

## Overview

CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrolling_list.

When rendering option groups, scrolling_list marks the selected options by interpolating each selected value, by default taken from the request parameters, unescaped into a substitution pattern.

A client can make the request die with an invalid pattern, or tie up the process with one that backtracks heavily.

## Affected

- `CGI < 5.00`

## Remediation

Upgrade to CGI 5.00 or later.