The CGI::Cookie module parses the Cookie request header and incorporates the expires value directly into a regex pattern without proper escaping. This flaw, identified as CWE-1333 (Improper Handling of Untrusted Input) and CWE-625 (Regular Expression Denial‑of‑Service), allows an attacker to submit a cookie value that contains an invalid or excessively complex regular expression, causing the module to crash or experience catastrophic backtracking.

All Perl environments that rely on CGI::Cookie versions v4.67 through v4.99 are affected. The vulnerability appears in CPAN releases such as LEEJO/CGI-4.xx and is resolved in the 5.00 release and later.

The CVSS score is 7.5, EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, so no public exploit reports exist at this time. Nonetheless, any client that can craft a Cookie header can trigger a denial-of-service either by crashing the parser or tying up the application process. The likely attack vector is a forged Cookie header sent by an attacker to the vulnerable server. The attack requires only network access to the target web service and does not depend on privileged internal APIs.