CVE-2026-19873: HTML::FormFu Perl Module DOS Vulnerability

CVE-2026-19873 Overview

CVE-2026-19873 is a resource exhaustion vulnerability in HTML::FormFu versions through 2.08 for Perl. The flaw allows unauthenticated attackers to trigger memory and CPU exhaustion through unbounded repeat counts in Repeatable form elements. When a Repeatable element has counter_name set, its process method reads the repeat count from the query string, validates only that it is a positive integer, and passes it to repeat, which deep-clones the child subtree once per iteration. Nested Repeatable elements multiply the effect, so an outer and inner value of 100 build 10,000 clones. A plain unauthenticated GET request reaches the clone loop without credentials or session state.

Critical Impact
A single crafted HTTP request can exhaust server memory and CPU, causing denial of service for any web application using HTML::FormFu with Repeatable elements and counter_name configured.

Affected Products

HTML::FormFu for Perl, all versions through 2.07 (released 2018, latest CPAN release)
HTML::FormFu version 2.08 (exists only in the git repository)
Perl web applications using Repeatable form elements with counter_name set

Discovery Timeline

2026-08-31 - CVE-2026-19873 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-19873

Vulnerability Analysis

The vulnerability resides in the process method of Repeatable elements within HTML::FormFu. When counter_name is configured, the module reads the associated query string parameter and interprets it as the number of times to clone the element's child subtree. The validation logic checks only that the value is a positive integer. No upper bound exists in the module, and no configuration attribute lets applications impose one.

Processing occurs on every request before the form determines whether it was actually submitted. An unauthenticated GET request reaches the clone loop without credentials, session state, or a request body. This makes the attack trivially reachable from anonymous network attackers.

The cost is amplified when Repeatable elements are nested. Each nesting level accepts its own counter, so an outer counter of 100 and inner counter of 100 produces 10,000 cloned subtrees. Once the form is submitted, each cloned field's constraints scan the whole element tree in _find_field_value, so processing cost grows faster than linearly with the repeat count. The vulnerability maps to [CWE-770: Allocation of Resources Without Limits or Throttling].

Root Cause

The root cause is missing input validation on an attacker-controlled loop counter. HTML::FormFu trusts the numeric value supplied via the query string parameter named by counter_name and performs deep clone operations proportional to that value. The library exposes no configuration option to cap the maximum repeat count, forcing applications to either avoid the feature or implement their own request filtering upstream.

Attack Vector

An attacker sends an unauthenticated HTTP GET request to any endpoint whose form definition includes a Repeatable element with counter_name set. By supplying a large integer for the configured counter parameter, the attacker triggers a large number of deep clone operations. Nested Repeatable elements multiply the clone count. The attack requires no authentication, no session, and no request body, and can be delivered from any network location.

Refer to the MetaCPAN Patch for CVE-2026-19873 and GitHub Issue #71 Discussion for technical specifics.

Detection Methods for CVE-2026-19873

Indicators of Compromise

HTTP GET or POST requests containing query string parameters matching configured counter_name values with unusually large integer values.
Sudden spikes in Perl process memory consumption or CPU utilization coinciding with requests to endpoints backed by HTML::FormFu forms.
Web server timeouts or worker process crashes on routes that render forms with Repeatable elements.

Detection Strategies

Inspect web access logs for query string parameters that map to any counter_name used in application form definitions, and flag values above a sensible application-defined threshold.
Correlate application performance metrics with incoming request patterns to identify single requests that produce disproportionate resource usage.
Audit Perl application source and configuration to enumerate all Repeatable elements with counter_name set, then monitor those specific parameters at the edge.

Monitoring Recommendations

Monitor Perl worker processes for memory growth exceeding baseline during form processing and configure alerts on out-of-memory conditions.
Track HTTP request duration percentiles per route and alert on outlier requests that consume excessive CPU time.
Log and review requests that trigger worker restarts, timeouts, or 5xx responses on endpoints that render HTML::FormFu forms.

How to Mitigate CVE-2026-19873

Immediate Actions Required

Inventory all Perl applications using HTML::FormFu and identify forms that declare Repeatable elements with counter_name.
Apply the patch from MetaCPAN Patch for CVE-2026-19873 or vendor the fix into local builds until an updated CPAN release is available.
Deploy web application firewall (WAF) rules that reject requests where counter parameters exceed a small, application-defined maximum.
Enforce per-process memory and CPU limits on Perl workers to contain the impact of a successful exploit attempt.

Patch Information

The latest release on CPAN is version 2.07, published in 2018, which remains vulnerable. Version 2.08 containing the fix exists only in the upstream git repository. Operators should apply the patch referenced in the MetaCPAN Patch for CVE-2026-19873 manually or track the git branch until a new CPAN release is cut. See the OpenWall OSS Security Post and OpenWall OSS Security Update for advisory context.

Workarounds

Remove or disable counter_name on Repeatable elements where dynamic client-controlled repetition is not required.
Add upstream request filtering in a reverse proxy or WAF to cap the numeric value of any parameter that maps to a counter_name.
Wrap the Repeatableprocess invocation in application code to clamp the incoming counter value before HTML::FormFu reads it.
Constrain Perl worker memory and request timeouts at the application server and process manager level to limit blast radius.

bash

# Example nginx snippet to cap a known counter parameter length
# Adjust parameter name to match your application's counter_name value
if ($arg_repeat_count ~ "^[0-9]{3,}$") {
    return 400;
}