UBUNTU-CVE-2026-19873

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-19873
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-19873.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-19873
Upstream
  • CVE-2026-19873
Published
2026-08-31T00:00:00Z
Modified
2026-09-01T21:00:04.489547673Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements. When a Repeatable element has countername set, its process method reads the repeat count from the named query string parameter, checks only that it is a positive integer, and passes it to repeat, which deep-clones the element's child subtree once per iteration. Nothing caps the value, and no attribute lets an application impose a limit. The count is read on every request, before the form decides whether it was submitted, so a plain GET reaches the clone loop with no credentials, no session and no request body. Nesting multiplies: a Repeatable inside a Repeatable takes a counter at each level, so an outer and an inner value of 100 build 10,000 clones. Once the form is submitted, each cloned field's constraints scan the whole element tree in findfieldvalue, so cost grows faster than linearly with the count. A single request exhausts memory and CPU. The latest release on CPAN is 2.07, from 2018. Version 2.08 exists only in the git repository.

References

Affected packages

Ubuntu:16.04:LTS
libhtml-formfu-perl

Package

Name
libhtml-formfu-perl
Purl
pkg:deb/ubuntu/libhtml-formfu-perl?arch=source&distro=xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.01000-2

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "2.01000-2",
            "binary_name": "libhtml-formfu-perl"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-19873.json"
Ubuntu:18.04:LTS
libhtml-formfu-perl

Package

Name
libhtml-formfu-perl
Purl
pkg:deb/ubuntu/libhtml-formfu-perl?arch=source&distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.05000-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "2.05000-1",
            "binary_name": "libhtml-formfu-perl"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-19873.json"
Ubuntu:20.04:LTS
libhtml-formfu-perl

Package

Name
libhtml-formfu-perl
Purl
pkg:deb/ubuntu/libhtml-formfu-perl?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.07000-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "2.07000-1",
            "binary_name": "libhtml-formfu-perl"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-19873.json"
Ubuntu:22.04:LTS
libhtml-formfu-perl

Package

Name
libhtml-formfu-perl
Purl
pkg:deb/ubuntu/libhtml-formfu-perl?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.07000-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "2.07000-1",
            "binary_name": "libhtml-formfu-perl"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-19873.json"
Ubuntu:24.04:LTS
libhtml-formfu-perl

Package

Name
libhtml-formfu-perl
Purl
pkg:deb/ubuntu/libhtml-formfu-perl?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.07000-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "2.07000-1",
            "binary_name": "libhtml-formfu-perl"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-19873.json"
Ubuntu:26.04:LTS
libhtml-formfu-perl

Package

Name
libhtml-formfu-perl
Purl
pkg:deb/ubuntu/libhtml-formfu-perl?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.07000-2

Ecosystem specific 

{
    "binaries": [
        {
            "binary_version": "2.07000-2",
            "binary_name": "libhtml-formfu-perl"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-19873.json"