PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade libapache2-mod-perl2 | Jul 30, 2024 | Mar 30, 2007 |
| Freebsd | — | Upgrade mod_perlUpgrade mod_perl2 | Dec 10, 2025 | Apr 24, 2007 |
| Gentoo Linux | — | Upgrade www-apache/mod_perl. | Oct 30, 2017 | Mar 29, 2007 |
| Oracle_linux | — | Upgrade mod_perlUpgrade mod_perl-devel | Oct 16, 2024 | Mar 30, 2007 |
| Suse | — | Upgrade apache2-mod_perl-develUpgrade apache2-mod_perl | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libapache2-mod-perl2 | Nov 8, 2024 | Mar 30, 2007 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub