CVE-2026-118993
Received Received - Intake

Denial of Service in CallBackery Perl Application

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: CPANSec

Description
CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI. The before_dispatch hook installed by startup() removes PATH_INFO from the end of the request URI with a substitution that interpolates PATH_INFO unquoted. Under CGI, FastCGI and PSGI both values come from the request, so the client chooses both the pattern and the string it is matched against. A short unauthenticated request with a backreference in the path backtracks exponentially and can keep a worker process busy for minutes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-118993
EUVD
EUVD-2026-113917

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
callbackery callbackery to 0.62.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1333 The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CallBackery versions before 0.62.0 for Perl have a denial of service vulnerability due to improper handling of the request path as a regular expression in CGI, FastCGI, and PSGI environments. The before_dispatch hook removes PATH_INFO from the request URI but interpolates it unquoted into a substitution, allowing an attacker to craft a path with a backreference that causes exponential backtracking. This keeps a worker process busy for minutes with a short unauthenticated request.

Impact Analysis

This vulnerability can cause denial of service by consuming server resources. An attacker could send a specially crafted request that triggers excessive CPU usage, slowing down or crashing the server. This may lead to degraded performance, downtime, or inability to serve legitimate users.

Mitigation Strategies

Upgrade CallBackery to version 0.62.0 or later to address the regex interpolation issue in the request path handling.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-118993. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart