{"id":"CVE-2026-123776","published":"2026-11-07T12:17:46.093","lastModified":"2026-11-10T14:17:16.707","description":"RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting \"tz\" to tzset(), , so a FIFO or device path blocks the CGI process.\n\nThe normalize_params method sends any query key matching /tz/i to tz(), which sets $ENV{TZ} to that value, with no validation. It then calls tzset(). glibc treats a TZ value starting with / or : as a file path and opens it, so a value naming a FIFO or a blocking device stalls the process inside tzset().","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-1287"],"vendors":[],"products":[],"references":[{"url":"https://man7.org/linux/man-pages/man3/tzset.3.html","tags":[]},{"url":"https://rt.cpan.org/Ticket/Display.html?id=182627","tags":[]},{"url":"https://security.metacpan.org/patches/R/RRD-CGI-Image/0.01/CVE-2026-123776-r1.patch","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/11/07/11","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"RRD::CGI::Image versions through 0.01 for Perl allow unauthenticated remote denial-of-service via the 'tz' CGI parameter, which is directly passed to tzset() without validation; glibc interprets values starting with '/' or ':' as file paths and attempts to open them, causing the process to block indefinitely when a FIFO or blocking device is specified.","exploitability":"Exploitation is trivial for unauthenticated remote attackers: sending a single HTTP request with a 'tz' parameter set to a path like '/dev/zero' or a named FIFO will stall the CGI process.","blast_radius":"Successful exploitation causes denial of service for all users of the affected CGI endpoint, potentially exhausting web server worker processes and degrading or halting service availability.","remediation":"Upgrade RRD::CGI::Image to version 0.02 or later, which validates and sanitizes the 'tz' parameter before passing it to tzset().","detection":"Look for prolonged-running CGI processes (e.g., httpd, nginx worker, or FastCGI processes) stuck in uninterruptible sleep (state 'D') while handling requests containing a 'tz' query parameter; check web server access and error logs for repeated requests with suspicious 'tz' values (e.g., paths starting with '/' or ':').","tags":["dos","input-validation","perl","cgi","glibc"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:49:53.562Z"}}