Your message dated Tue, 01 Sep 2026 01:04:44 +0000
with message-id <[email protected]>
and subject line Bug#1146310: fixed in libhtml-formfu-perl 2.07000-3
has caused the Debian Bug report #1146310,
regarding libhtml-formfu-perl: CVE-2026-19873
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1146310: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1146310
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: libhtml-formfu-perl
Version: 2.07000-2
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Control: found -1 2.07000-1
Hi,
The following vulnerability was published for libhtml-formfu-perl.
CVE-2026-19873[0]:
| HTML::FormFu versions through 2.08 for Perl allow resource
| exhaustion via an unbounded repeat count from the query string in
| Repeatable elements. When a Repeatable element has counter_name
| set, its process method reads the repeat count from the named query
| string parameter, checks only that it is a positive integer, and
| passes it to repeat, which deep-clones the element's child subtree
| once per iteration. Nothing caps the value, and no attribute lets an
| application impose a limit. The count is read on every request,
| before the form decides whether it was submitted, so a plain GET
| reaches the clone loop with no credentials, no session and no
| request body. Nesting multiplies: a Repeatable inside a Repeatable
| takes a counter at each level, so an outer and an inner value of 100
| build 10,000 clones. Once the form is submitted, each cloned
| field's constraints scan the whole element tree in
| _find_field_value, so cost grows faster than linearly with the
| count. A single request exhausts memory and CPU. The latest release
| on CPAN is 2.07, from 2018. Version 2.08 exists only in the git
| repository.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-19873
https://www.cve.org/CVERecord?id=CVE-2026-19873
[1] https://lists.security.metacpan.org/cve-announce/msg/43141785/
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: libhtml-formfu-perl
Source-Version: 2.07000-3
Done: gregor herrmann <[email protected]>
We believe that the bug you reported is fixed in the latest version of
libhtml-formfu-perl, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
gregor herrmann <[email protected]> (supplier of updated libhtml-formfu-perl
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 01 Sep 2026 02:31:12 +0200
Source: libhtml-formfu-perl
Architecture: source
Version: 2.07000-3
Distribution: unstable
Urgency: medium
Maintainer: Debian Perl Group <[email protected]>
Changed-By: gregor herrmann <[email protected]>
Closes: 1146310
Changes:
libhtml-formfu-perl (2.07000-3) unstable; urgency=medium
.
* Add patch from CPANSec to fix resource exhaustion vulnerability
(CVE-2026-19873). (Closes: #1146310)
* Update years of packaging copyright.
* Declare compliance with Debian Policy 4.7.4.
* Remove «Rules-Requires-Root: no», which is the current default.
* Remove «Priority: optional», which is the current default.
* Convert debian/watch to version 5.
Checksums-Sha1:
aec9f946a79927c4ccdb0c13aa4eea262127e76b 3651 libhtml-formfu-perl_2.07000-3.dsc
17bed8352cb68421a2085e64ee3cad9af90e6637 8028
libhtml-formfu-perl_2.07000-3.debian.tar.xz
d4f5490bd10e7f2f3bdfa36bd58200fac5e505b5 1085580
libhtml-formfu-perl_2.07000-3.git.tar.xz
f4746552dc8ea11d8a8c86a0e143dfa23f818c81 17724
libhtml-formfu-perl_2.07000-3_source.buildinfo
Checksums-Sha256:
939f12f9f44465b3e7e6945a9ead9fb74d707ed2ca09690fc0cc563c075d27ea 3651
libhtml-formfu-perl_2.07000-3.dsc
a1ae3d5b7d2602611a9753c2337cfaddcbf34098e6ebc93f435333bc66575681 8028
libhtml-formfu-perl_2.07000-3.debian.tar.xz
b6573f9ccba3ddea77f0237edc77d1533a1bf20c7483e93f7c0e197d191b854a 1085580
libhtml-formfu-perl_2.07000-3.git.tar.xz
10cfb64c0501b77455eebc05fec18eeb92e33ec2367590d55e82dd2abf6d2241 17724
libhtml-formfu-perl_2.07000-3_source.buildinfo
Files:
75c702a5d59cc25c8be2af60008d519e 3651 perl optional
libhtml-formfu-perl_2.07000-3.dsc
f0bd3a71559669a9d3136db8d9f7180c 8028 perl optional
libhtml-formfu-perl_2.07000-3.debian.tar.xz
4a1fc54672b302ec0f5f4d4a9620790c 1085580 perl None
libhtml-formfu-perl_2.07000-3.git.tar.xz
129ed76b80bb79663641557de881e56b 17724 perl optional
libhtml-formfu-perl_2.07000-3_source.buildinfo
Git-Tag-Info: tag=9dc19abcf8b0d988551e3dcb9d4f817a4bac6151
fp=d1e1316e93a760a8104d85fabb3a68018649aa06
Git-Tag-Tagger: gregor herrmann <[email protected]>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmqWH7cACgkQYG0ITkaD
wHlZ7xAAj58z5umiW/SL2ZDxGSk3QFixPY/vqQJsNxC5aZ2gJ6AbE3zZ1h0uYmcW
aFaS+a6vfHEMGOaLGjUU4QU9JTyKmwxac32ZQGLB0H8iqwe5qGwp4OmoDaBqsWbp
vF9Dt1kAWH/bWnv9QNRCUGl0/5ETi4Wy5KcmrWx8dMCRdaIaR/I+jI2fSM9WkL/f
1SIA9pDouCZOeGGBGF4aCNnv2ZlV3bjlFzOrK4uzgIjajxCkFgkOKMxjPwHYPUL/
BTrYujDq27b6h7QwCuGPc0fkZFVh/W5nwXi06ngO1qUiPWj1PqKn+em1tdbOWj+E
Y+uaaF+Q6IyymnyrXinh9LrgJcnKpba+c2NJSa6LHIO4f44RQpGovSiJVuiKD7J0
zo5Xf+voy5t98YTpp9pSZ2ON8nbg47+QsUivTAit5kxCHlf9gYz1DmN1/kcSZvjy
M3XhtS4o+vnivhBuZfoRFeb36HoqO9JDgXPJLfFBJVqjHaqFat+PgPStQfnu+wdw
3whuGa3+Kd4gRkINHqCDG/GjZbI+JXfk6E3oZWfxIsTAT0urs/d2tbJs/UAsTMJS
kEIt3lSWt3wHK341CIr0Yh4nRsx3+Rkl420S1L8M6kdQ3QbNG9NNVqiarherZBHO
j51wZNxMP9FdcKKSQf9k4xXuNuaCyG9mgtnqYLmRxNwYBFSvx/s=
=/WxF
-----END PGP SIGNATURE-----
pgpF2xREQFJaX.pgp
Description: PGP signature
--- End Message ---
