Description

HTML::FormHandler versions through 0.40068 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template. add_error hands its first argument to the language handle as the Locale::Maketext message key, and the default handle's lexicon sets `_AUTO`, so a string that is not a lexicon entry is compiled as a bracket notation template instead of being looked up. In a bracket group the first token names a method called on the language handle and the remaining tokens are its arguments. Three kinds of text the library did not author reach that position. _apply_actions installs a `$SIG{__WARN__}` handler that stores the warning text in `$error_message`, and a captured warning survives a successful action, so a field carrying a numeric transform turns `Argument "[sprintf,%50000000d,0]" isn't numeric` into the template; a warning quotes the submitted value verbatim, so the group is well formed and dispatches. `$error_message ||= $tobj->validate($new_value)` takes a type constraint's own failure message, which renders the rejected value through a partial dumper in bracket and comma form (Devel::PartialDump when Moose can load it, Type::Tiny's own dumper always), so a field with `apply => [ Str ]` given a parameter sent more than once, which arrives as an array, gets `Reference ["a","b"] did not pass type constraint "Str"` as its template, from a request that carries no bracket character of its own. A coercion or transform exception reaches it the same way. Beyond those, a validator whose message contains the field value puts that value in the template directly, and add_error replaces the message list with the contents of an arrayref first argument (`@message = @{$message[0]} if ref $message[0] eq 'ARRAY'`), so a value arriving as an array fills the argument slots from the same request as well. A malformed group such as `[0]` makes the compile croak, and HTML::FormHandler::I18N::maketext and add_error each re-raise that as a die, so process() throws. A well formed group naming sprintf reaches CORE::sprintf with an attacker chosen field width. Any caller that applies a type constraint or a transform to an untrusted field, or whose validator passes an untrusted field value to add_error, can be made to throw an unhandled exception out of process(), or to allocate an arbitrary amount of memory in one request, and an application whose language handle subclass defines side effecting public methods makes those callable with attacker chosen arguments. The dumped type constraint message is bounded to the exception, because both dumpers quote non-numeric elements so the method slot is never an attacker chosen name. The built-in messages pass fixed templates with the value in an argument slot, where it stays inert, and the built-in field types attach explicit message callbacks, so neither is affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-13T17:17:17.780Z",
  "pubdate": "2026-08-13T17:17:17.780Z",
  "executiveSummary": "HTML::FormHandler through version 0.40068 suffers from an attacker-controlled method dispatch and resource exhaustion vulnerability stemming from insecure handling of error messages via Locale::Maketext bracket notation templates.\nThe vulnerability allows an unauthenticated remote attacker to cause a denial of service through excessive memory allocation or trigger unhandled exceptions leading to application crashes during the form processing lifecycle.\nThe root issue affects applications utilizing HTML::FormHandler where untrusted user input is processed through type constraints, transforms, or custom validators that pass error messages containing request data directly into add_error or _apply_actions.\nBecause the default Locale::Maketext language handle lexicon sets `_AUTO`, any string not recognized as a lexicon entry is compiled as a bracket notation template. This enables attackers to craft inputs that execute arbitrary methods on the language handle or trigger massive resource consumption, such as through oversized sprintf width arguments.\nNo specific authentication or privileges are required to exploit this flaw beyond the ability to submit form parameters to an affected Perl application.",
  "technicalDetails": "The vulnerability resides in HTML::FormHandler's error messaging mechanism, specifically within _apply_actions and add_error functions. These components construct error message text using request data and pass it to the language handle as a Locale::Maketext message key.\nThe default language handle's lexicon sets `_AUTO`, meaning any string that lacks an explicit lexicon entry is compiled as a bracket notation template. In a Locale::Maketext bracket group, the initial token specifies a method to be invoked on the language handle, while subsequent tokens supply arguments.\nThree primary pathways introduce untrusted text into this position: First, _apply_actions installs a $SIG{__WARN__} handler capturing warning text into $error_message. A field carrying a numeric transform converts a warning like Argument \"[sprintf,%50000000d,0]\" isn't numeric into a valid bracket template that dispatches to CORE::sprintf with an attacker-controlled field width, driving massive memory allocation. Second, $error_message ||= $tobj->validate($new_value) captures type constraint failure messages generated via Devel::PartialDump or Type::Tiny's dumper. Providing array references to fields with type constraints such as Str results in templates like Reference [\"a\",\"b\"] did not pass type constraint \"Str\". Third, custom validators incorporating field values directly into messages or array-based arguments passed to add_error allow parameter injection into argument slots.\nExploitation proceeds step-by-step as follows: an attacker submits specially crafted input vectors (such as non-numeric values triggering warnings with large sprintf widths or arrays violating type constraints) via standard request parameters. The input propagates through form validation or warning handlers, generating un-sanitized error strings. The vulnerable functions pass these strings to Locale::Maketext, which evaluates them as bracket notation templates. Depending on the payload, the template either triggers an unhandled exception causing process() to throw and crash the application, allocates massive amounts of memory via unbounded formatting arguments, or invokes public methods on language handle subclasses if side-effecting methods are defined.\nAffected versions include HTML::FormHandler through 0.40068. The vulnerable components are _apply_actions, add_error, and HTML::FormHandler::I18N::maketext. Exploitation requires network exposure of the Perl application processing untrusted form inputs, with no prior authentication or privileges needed."
}