The vulnerability lies in the way CallBackery before_dispatch hook handles PATH_INFO by interpolating it directly into a regular expression. A client can supply an unauthenticated request whose path contains a backreference, causing the regex engine to perform exponential backtracking and exhaust the worker process, resulting in a denial of service. This flaw stems from improper handling of user-controlled input in a regular expression (CWE‑1333).

The issue affects the CallBackery Perl web framework in its CGI, FastCGI and PSGI modes. All versions prior to 0.62.0 are vulnerable; the patch was released in CallBackery 0.62.0 and later.

The vulnerability can be triggered by any client via an unauthenticated HTTP request; the attacker controls both the regex pattern and the string being matched. No authentication or elevated privileges are required. Exploitation requires only knowledge of the request format. The EPSS score is not available and the flaw is not listed in the CISA KEV, but the denial‑of‑service impact can keep a worker process busy for minutes, which can lead to resource exhaustion and availability degradation. Attackers can launch the exploit over the network from anywhere with connectivity to the application.