https://bugzilla.redhat.com/show_bug.cgi?id=2536983
Bug ID: 2536983
Summary: CVE-2026-19873 perl-HTML-FormFu: HTML::FormFu: Denial
of Service via unbounded repeat count in Repeatable
elements [fedora-all]
Product: Fedora
Version: rawhide
Status: NEW
Whiteboard: {"flaws": ["5fb6f2cf-40cc-48df-bb80-7fbfe4a8d42e"]}
Component: perl-HTML-FormFu
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
CC: [email protected], [email protected]
Blocks: 2526232 (CVE-2026-19873)
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an
unbounded repeat count from the query string in Repeatable elements.
When a Repeatable element has counter_name set, its process method reads the
repeat count from the named query string parameter, checks only that it is a
positive integer, and passes it to repeat, which deep-clones the element's
child subtree once per iteration. Nothing caps the value, and no attribute lets
an application impose a limit.
The count is read on every request, before the form decides whether it was
submitted, so a plain GET reaches the clone loop with no credentials, no
session and no request body. Nesting multiplies: a Repeatable inside a
Repeatable takes a counter at each level, so an outer and an inner value of 100
build 10,000 clones.
Once the form is submitted, each cloned field's constraints scan the whole
element tree in _find_field_value, so cost grows faster than linearly with the
count. A single request exhausts memory and CPU.
The latest release on CPAN is 2.07, from 2018. Version 2.08 exists only in the
git repository.
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2526232
[Bug 2526232] CVE-2026-19873 perl-HTML-FormFu: HTML::FormFu: Denial of Service
via unbounded repeat count in Repeatable elements
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2536983
Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-spam&short_desc=Report%20of%20Bug%202536983%23c0
--
_______________________________________________
perl-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
