CVE-2026-123776 RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset(), , so a FIFO or device path blocks the CGI process
CriticalCVSS 9.8
- Published
- Updated
- Exploit status
- No public exploit known
Description
RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset(), , so a FIFO or device path blocks the CGI process.
The normalize_params method sends any query key matching /tz/i to tz(), which sets $ENV{TZ} to that value, with no validation. It then calls tzset(). glibc treats a TZ value starting with / or : as a file path and opens it, so a value naming a FIFO or a blocking device stalls the process inside tzset().
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cpan RRD-CGI-Image | <= 0.01 | No fix listed |
References
- rt.cpan.org issue-tracking patch vendor-advisory
- man7.org technical-description
- security.metacpan.org patch
- www.openwall.com