Vulnerability Description
CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI. The before_dispatch hook installed by startup() removes PATH_INFO from the end of the request URI with a substitution that interpolates PATH_INFO unquoted. Under CGI, FastCGI and PSGI both values come from the request, so the client chooses both the pattern and the string it is matched against. A short unauthenticated request with a backreference in the path backtracks exponentially and can keep a worker process busy for minutes.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-118993?
CVE-2026-118993 is a documented vulnerability. CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI. The before_dispatch hook installed by startu...
How severe is CVE-2026-118993?
CVSS scoring is not yet available for CVE-2026-118993. Check NVD for updates.
Is there a patch for CVE-2026-118993?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.