CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI…
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 0.62.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
CallBackery for Perl, before version 0.62.0, is affected under CGI, FastCGI, and PSGI deployments. An unauthenticated attacker can send a crafted request path that causes the server to run an extremely slow pattern match, tying up a worker process for minutes and resulting in denial of service.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI. The before_dispatch hook installed by startup() removes PATH_INFO from the end of the request URI with a substitution that interpolates PATH_INFO unquoted. Under CGI, FastCGI and PSGI both values come from the request, so the client chooses both the pattern and the string it is matched against. A short unauthenticated request with a backreference in the path backtracks exponentially and can keep a worker process busy for minutes.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- CallBackery
fixed in 0.62.0