CVE-2026-19873: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-19873 is a Denial of Service vulnerability in HTML::FormFu (a Perl form-handling library) caused by an unbounded repeat count accepted from the query string in Repeatable form elements. All versions through 2.08 are affected; the latest CPAN release is 2.07 (2018), and version 2.08 exists only in the git repository. The vulnerability was disclosed on August 31, 2026, assigned by CPANSec, and published to the GitHub Advisory Database the same day. A CVSS base score has not yet been formally assigned, though the severity is estimated as Medium (GitHub Advisory, GitHub Issue).

The root cause is improper validation of a user-supplied quantity (CWE-770: Allocation of Resources Without Limits or Throttling; CWE-1284: Improper Validation of Specified Quantity in Input). In Element/Repeatable.pm, when counter_name is set, the process() method reads the repeat count directly from the named query string parameter, validates only that it matches /^[1-9][0-9]*\z/ (a positive integer), and passes it to repeat(), which deep-clones the element's child subtree once per iteration with no upper bound. The clone loop executes on every request before the form's submitted/not-submitted decision, meaning a plain unauthenticated HTTP GET with a large counter value triggers the expensive operation. Nesting amplifies the effect exponentially: two nested Repeatable elements with outer_count=100&inner_count=100 produce 10,000 clones (~95 MB RSS). After submission, each cloned field's constraints invoke _find_field_value, which walks the entire element tree, making CPU cost super-linear — benchmarks on v2.07 show that doubling the count multiplies CPU time by 4–5×, and a five-digit value represents CPU-hours from a single request (GitHub Issue, GitHub Advisory).

A single unauthenticated HTTP GET request with a crafted query string parameter can exhaust both memory and CPU on the hosting server, causing the application to crash or become unresponsive. Because no authentication, session, or POST body is required, any internet-facing application using HTML::FormFu with Repeatable elements and counter_name configured is at risk. The impact is limited to availability (Denial of Service); there is no evidence of confidentiality or integrity compromise (GitHub Issue, GitHub Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. However, the attack requires no authentication and is trivially reproducible with a crafted HTTP GET request, lowering the practical barrier for exploitation (GitHub Advisory).

1. Reconnaissance: Identify web applications built with Perl and HTML::FormFu that expose forms using Repeatable elements with counter_name configured (e.g., by inspecting HTML source for repeatable form field naming patterns or reviewing publicly available application code).
2. Identify the counter parameter: Determine the query string parameter name mapped to counter_name in the target form (e.g., count, repeat_count, or a custom name visible in the form's HTML or documentation).
3. Craft a malicious GET request: Send an HTTP GET request to the form endpoint with a large integer value for the counter parameter, e.g., GET /form?count=100000. No session cookie, authentication header, or POST body is required.
4. Amplify with nested Repeatables: If the form contains nested Repeatable elements, supply large values for both counters (e.g., ?outer_count=1000&inner_count=1000) to produce multiplicative resource consumption (1,000,000 clones).
5. Trigger constraint scanning: Optionally submit the form (POST) with the inflated counter to activate the super-linear _find_field_value constraint-scanning phase, further multiplying CPU cost.
6. Observe impact: The server process exhausts available memory and CPU, causing the application to crash or become unresponsive to legitimate users (GitHub Issue).

• Network: Repeated HTTP GET or POST requests to form endpoints containing query string parameters with unusually large integer values (e.g., count=99999, repeat=100000); requests arriving with no session cookie or authentication headers targeting form URLs.
• Logs: Web server access logs showing requests to form endpoints with large numeric query parameters; application error logs showing out-of-memory errors or process crashes originating from Element/Repeatable.pm or HTML::FormFu::Constraint::_find_field_value.
• Process: Perl worker processes consuming abnormally high CPU (approaching 100%) or memory (hundreds of MB to GB) for extended periods following receipt of a single request; sudden process termination due to OOM killer activation.

A patch is available at the CPANSec patch repository (CVE-2026-19873-r1.patch) and should be applied to HTML::FormFu installations. Operators should monitor for an updated CPAN release incorporating the fix. As interim workarounds: cap the maximum value of counter_name query parameters at the application or web server/WAF layer (e.g., reject or clamp values above a reasonable maximum such as 20–50); implement rate limiting on form endpoints; and audit all forms using Repeatable elements with counter_name to assess exposure (GitHub Advisory, CPANSec Patch).

The vulnerability was reported to CPANSec and publicly disclosed via the HTML-FormFu GitHub issue tracker at the request of the project maintainer Dean Hamstead. The issue was machine-generated for CPANSec and assigned CVE-2026-19873, with the oss-security mailing list also notified. No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been observed (GitHub Issue, oss-sec).