CVE-2026-123776

Summary

RRD::CGI::Image versions through 0.01 for Perl allow unauthenticated remote denial-of-service via the 'tz' CGI parameter, which is directly passed to tzset() without validation; glibc interprets values starting with '/' or ':' as file paths and attempts to open them, causing the process to block indefinitely when a FIFO or blocking device is specified.

Exploitability

Exploitation is trivial for unauthenticated remote attackers: sending a single HTTP request with a 'tz' parameter set to a path like '/dev/zero' or a named FIFO will stall the CGI process.

Blast radius

Successful exploitation causes denial of service for all users of the affected CGI endpoint, potentially exhausting web server worker processes and degrading or halting service availability.

Detection

Look for prolonged-running CGI processes (e.g., httpd, nginx worker, or FastCGI processes) stuck in uninterruptible sleep (state 'D') while handling requests containing a 'tz' query parameter; check web server access and error logs for repeated requests with suspicious 'tz' values (e.g., paths starting with '/' or ':').

Prioritized remediation

Upgrade RRD::CGI::Image to version 0.02 or later, which validates and sanitizes the 'tz' parameter before passing it to tzset().

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.