The flaw is in HTML::FormFu’s handling of Repeatable elements – the processor blindly accepts a repeat count from the query string, only verifying that it is a positive integer. That count is then used to deep‑clone the element’s child tree an equal number of times. No limit is enforced and no attribute allows the application to impose one, so a request such as ?counter=1000 will cause the application to create an enormous number of form fields. Nested Repeatables further amplify the effect; two levels at 100 each produce 10,000 clones. After the form is submitted, each cloned field is validated by scanning the entire tree, so the processing cost grows super‑linearly with the count. Because the count is read on every request before authentication is checked, a simple unauthenticated GET can drain the server’s CPU and memory, leading to a denial of service. The vulnerability is essentially a critical resource exhaustion flaw. This flaw corresponds to CWE-1284 and CWE-770.

All installations of Perl module HTML::FormFu version 2.08 or earlier are affected. The latest released version on CPAN is 2.07 from 2018, but version 2.08 exists only in the git repository. Any application that has deployed the module from either source and uses a Repeatable element with counter_name set is vulnerable. The issue does not affect newer releases once the patch is applied or the counter handling logic is corrected.

The exploit requires only an HTTP request with a crafted repeat count in the query string; no authentication or privileged access is necessary. The effort is minimal, and the attack surface is wide because any client‑facing form using the vulnerable pattern can be targeted. The absence of a bound on the count immediately translates into a critical resource exhaustion vector. The CVSS score of 7.5 indicates a high severity, and the risk is inferred from the nature of the flaw and the public visibility of the affected code.