CVE-2026-123776
Received Received - Intake

Time Zone Handling Flaw in RRD::CGI::Image

Publication date: 2026-11-07

Last updated on: 2026-11-07

Assigner: CPANSec

Description
RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset(), , so a FIFO or device path blocks the CGI process. The normalize_params method sends any query key matching /tz/i to tz(), which sets $ENV{TZ} to that value, with no validation. It then calls tzset(). glibc treats a TZ value starting with / or : as a file path and opens it, so a value naming a FIFO or a blocking device stalls the process inside tzset().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-07
Last Modified
2026-11-07
Generated
2026-11-07
AI Q&A
2026-11-07
EPSS Evaluated
N/A
NVD
CVE-2026-123776
EUVD
EUVD-2026-119210

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
rrd cgi_image 0.01
rrd cgi_image to 0.01 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1287 The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the RRD::CGI::Image Perl module passing unvalidated CGI query parameters containing 'tz' to the tzset() function. The normalize_params method sends these parameters directly to tz(), setting $ENV{TZ} without checking if the value is a file path. glibc interprets TZ values starting with '/' or ':' as file paths, causing the process to hang while attempting to read the file, leading to a denial-of-service condition.

Detection Guidance

Check CGI query parameters for 'tz' values in RRD::CGI::Image requests. Monitor for processes hanging during tzset() calls, especially when TZ env var contains file paths like / or :/. Use system logs to detect blocked CGI processes.

Impact Analysis

An attacker could exploit this by sending a crafted CGI query with a 'tz' parameter pointing to a FIFO or blocking device. This would stall the CGI process, causing it to hang indefinitely and potentially disrupting services relying on the RRD::CGI::Image module. It may lead to degraded performance or complete unavailability of affected applications.

Mitigation Strategies

Update RRD::CGI::Image to patched version. Validate all 'tz' parameters to reject file paths starting with / or :/ or containing .. . Set strict input validation for CGI query parameters before processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-123776. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...