CVE-2026-19873 HTML::FormFu CVE debrief

Who should care

Users of HTML::FormFu versions through 2.08 for Perl should be concerned about this vulnerability, as it can be exploited via a simple GET request, and a single request can exhaust memory and CPU. Affected operators, platforms, and security teams should review and apply vendor guidance, implement compensating controls, and monitor for potential exploitation attempts.

Technical summary

HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements. When a Repeatable element has counter_name set, its process method reads the repeat count from the named query string parameter, checks only that it is a positive integer, and passes it to repeat, which deep-clones the element's child subtree once per iteration. This can lead to a large number of clones, causing memory and CPU exhaustion. The vulnerability can be exploited via a simple GET request.

Defensive priority

This vulnerability allows for resource exhaustion via an unbounded repeat count from the query string in Repeatable elements in HTML::FormFu versions through 2.08 for Perl. A single request can exhaust memory and CPU, making it a high-priority defensive concern.

Recommended defensive actions

• Verify and apply vendor remediation if available
• Implement compensating controls to limit exposure
• Monitor for and respond to potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the lack of a cap on the repeat count in Repeatable elements, which can lead to deep-cloning of the element's child subtree and exhaustion of memory and CPU. The latest release on CPAN is 2.07, from 2018, and version 2.08 exists only in the git repository. Limited information available; further verification needed.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.