CVE-2026-19873

Name of the Vulnerable Software and Affected Versions HTML::FormFu versions prior to 2.09

Description Repeatable elements allow resource exhaustion through an unbounded repeat count provided via the query string. When a Repeatable element has counter name set, the process() function reads the repeat count from the query string parameter and performs a deep-clone of the element's child subtree for each iteration without a maximum limit. This process occurs on every request, meaning a GET request can trigger the loop without requiring credentials or a session. Nesting Repeatable elements multiplies the number of clones, and the find field value() function further increases CPU and memory consumption by scanning the entire element tree for each cloned field's constraints. This can lead to complete exhaustion of system memory and CPU.

Recommendations Update HTML::FormFu to a version later than 2.08.