CVE-2026-123776: RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset(), , so a FIFO or device

CVE-2026-123776: RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset(), , so a FIFO or device path blocks the CGI process

Reported by oss-security

Summary by Cyber Security News7 Nov 2026, 19:55 CET

About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/575

Posted by Robert Rothenberg on Nov 07 CVE-2026-123776 CPAN Security Group CVE ID: CVE-2026-123776 Distribution: RRD-CGI-Image Versions: through 0.01 MetaCPAN: https://metacpan.org/dist/RRD-CGI-Image RRD::CGI::Image versions through 0.01...

Read the full article at oss-security →

Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

CVE-2026-121265: SQL::Abstract versions before 2.000003 for Perl allow SQL injection via an arrayref column value in insert and update

No need to hack when it’s leaking: Artex edition

ARTEX abuse expands as cybercriminals target financial sector

Re: "sshole": password authentication bypass: OpenSSH + musl libc

CVE-2026-118196: Apache Allura: OAuth1 rebinding

[oss-security][CVE-2026-119170] Regression in FIPS enforcement of hash algorithms affecting only Python 3.14.10