Source: libhtml-formfu-perl Version: 2.07000-2 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]> Control: found -1 2.07000-1
Hi, The following vulnerability was published for libhtml-formfu-perl. CVE-2026-19873[0]: | HTML::FormFu versions through 2.08 for Perl allow resource | exhaustion via an unbounded repeat count from the query string in | Repeatable elements. When a Repeatable element has counter_name | set, its process method reads the repeat count from the named query | string parameter, checks only that it is a positive integer, and | passes it to repeat, which deep-clones the element's child subtree | once per iteration. Nothing caps the value, and no attribute lets an | application impose a limit. The count is read on every request, | before the form decides whether it was submitted, so a plain GET | reaches the clone loop with no credentials, no session and no | request body. Nesting multiplies: a Repeatable inside a Repeatable | takes a counter at each level, so an outer and an inner value of 100 | build 10,000 clones. Once the form is submitted, each cloned | field's constraints scan the whole element tree in | _find_field_value, so cost grows faster than linearly with the | count. A single request exhausts memory and CPU. The latest release | on CPAN is 2.07, from 2018. Version 2.08 exists only in the git | repository. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-19873 https://www.cve.org/CVERecord?id=CVE-2026-19873 [1] https://lists.security.metacpan.org/cve-announce/msg/43141785/ Regards, Salvatore
