CGI Perl versions prior to 5.00 contain a regular expression that backtracks in cubic time when parsing the boundary and start parameters of a multipart/related Content-Type header. The pattern is unanchored and places a .+ on either side of the boundary capture, causing a CPU‑intensive backtracking operation when the header does not match the expected format. An attacker can trigger this by sending a POST request whose Content-Type header is extremely long; no request body is required. The result is a denial‑of‑service condition that exhausts processing cycles on the server running the CGI module.

Perl CGI module installations that are older than version 5.00 will be affected when they process multipart/related requests. This includes any web application or server that loads the CGI package and accepts multipart/related Content-Type headers, regardless of the underlying web server environment.

The vulnerability is remote and can be triggered by any entity that can send HTTP POST requests to the affected application. The exploitation path requires only the ability to craft an oversized Content-Type header; no special privileges or credentials are needed. EPSS information is not available, and the issue is not listed in the CISA KEV catalog. The CVSS score is 5.3, indicating moderate severity. However, the nature of the CPU exhaustion and the lack of a body requirement make it a low‑effort, high‑impact denial‑of‑service attack for which many potential targets could be vulnerable.