Red Hat Security Advisory: perl-CGI security update

🔗 CVE IDs covered (3)

📋 Description

🎯 Affected products3

• Red Hat Enterprise Linux AppStream EUS (v.9.8)
• perl-CGI-0:4.51-5.el9_8.1.noarch as a component of Red Hat Enterprise Linux AppStream EUS (v.9.8)
• perl-CGI-0:4.51-5.el9_8.1.src as a component of Red Hat Enterprise Linux AppStream EUS (v.9.8)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: --- CME Mitigation Guidance (2026-11-04) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to sanitize client-supplied upload filenames or canonicalize destination paths before saving files in applications using CGI.pm: upgrade to CGI 5.00+ (or the fixed Perl Cgi builds), which strip control characters and directory segments separated by forward slashes and backslashes from upload filenames, defaulting to 'upload' if no usable name remains, closing all 3 injection vectors (multipart Content-Disposition filenames with relative directory traversal sequences, multipart Content-Disposition filenames with absolute path segments, multipart Content-Disposition filenames with Windows path separators). Until patched, this is a concern on Applications on any platform using CGI.pm to handle multipart/form-data file uploads that save files under the returned filename, so Implement independent path sanitization or canonicalization in application code to ensure destination paths remain strictly confined to designated upload directories before saving files. As a compensating measure, Inspect HTTP multipart/form-data payloads with a web application firewall to detect and block traversal sequences inside the Content-Disposition filename parameter, Log kernel-level filesystem write events using auditd to provide forensic visibility when files are created outside the intended upload directory, Monitor file-system write operations with Falco or eBPF runtime security to alert on unexpected file creation outside standard upload directories by the web process, and Deploy file integrity monitoring such as AIDE to detect unauthorized creation or modification of critical system files resulting from traversal writes. These controls limit blast radius and contain exploitation, but they do not fix the underlying path traversal vulnerability — apply the upstream patch to fully remediate. Highest-impact CME: CME-1301 Path Traversal Prevention (Canonicalization) (high) Workaround: --- CME Mitigation Guidance (2026-11-04) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to enforce strict allowlist validation on all CGI request parameters and upload metadata before passing them into sensitive operations: upgrade to CGI 5.00 (or the fixed Perl Cgi builds), which append a tainted substring to request-derived hash keys and regex capture values before returning them, closing all 5 injection vectors (crafted upload filenames, crafted uploadInfo header values, crafted path_info or script_name values, crafted Accept header values, crafted url_param or cookie names). Until patched, this is a concern on applications running under Perl taint mode (-T) that rely on taint verification for CGI request metadata and parameter keys, so audit and explicitly untaint or validate all request metadata, file upload headers, and parameter names before passing them to sensitive functions like open or system. As a compensating measure, use direct process execution without shell invocation when passing CGI-derived values to process sinks, validate and sanitize upload filenames and uploadInfo headers against strict extension and content allowlists before processing, run SELinux in enforcing mode to confine the web server and CGI process domain, and apply enforcing AppArmor profiles to restrict file access and process execution for CGI scripts. These controls limit blast radius and contain exploitation, but they do not fix the underlying taint-check bypass defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1315 Allowlist-Preferred Input Validation (Deny-by-Default Filtering) (high) Workaround: --- CME Mitigation Guidance (2026-11-04) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to enforce strict upper bounds on incoming request body sizes, parameter counts, boundary lengths, and file uploads within the web server or proxy layer before reaching CGI scripts: upgrade to CGI 5.00 (or the fixed Perl Cgi builds), which enforce a default 128MB POST_MAX dynamically during reads, process postdata in bounded chunks, cap initial boundary lines at 1KB, and reject requests exceeding 10,000 parameters or 1,000 uploads with HTTP 413, closing all 5 injection vectors (monolithic in-memory slurping of large POST, PUT, or PATCH request bodies, unbounded multipart boundary line read lacking a boundary parameter, chunked multipart payloads bypassing static CONTENT_LENGTH checks, excessive parameter counts in URL queries or form bodies, excessive multipart file uploads exhausting file descriptors and disk space). Until patched, this is a concern on applications accepting HTTP POST, PUT, PATCH, or multipart requests using perl-CGI prior to version 5.00, so restrict maximum allowed HTTP body sizes, parameter quantities, and file upload counts at upstream reverse proxies or web servers, and reject requests lacking a boundary parameter on multipart content types. As a compensating measure, monitor cgroup memory pressure via memory.events and PSI to detect anomalous memory surges and imminent out-of-memory conditions, constrain process address space and maximum file sizes using ulimit or prlimit to contain denial of service, and enforce hard cgroups v2 memory and CPU resource bounds on the Perl application process to limit blast radius. These controls limit blast radius and contain exploitation, but they do not fix the underlying unenforced request and upload limits defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)

🔗 References (6)

• selfhttps://access.redhat.com/errata/RHSA-2026:99213
• externalhttps://access.redhat.com/security/updates/classification/#important
• externalhttps://bugzilla.redhat.com/show_bug.cgi?id=2566595
• externalhttps://bugzilla.redhat.com/show_bug.cgi?id=2566598
• externalhttps://bugzilla.redhat.com/show_bug.cgi?id=2566605
• selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_99213.json