Description

HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements. When a Repeatable element has counter_name set, its process method reads the repeat count from the named query string parameter, checks only that it is a positive integer, and passes it to repeat, which deep-clones the element's child subtree once per iteration. Nothing caps the value, and no attribute lets an application impose a limit. The count is read on every request, before the form decides whether it was submitted, so a plain GET reaches the clone loop with no credentials, no session and no request body. Nesting multiplies: a Repeatable inside a Repeatable takes a counter at each level, so an outer and an inner value of 100 build 10,000 clones. Once the form is submitted, each cloned field's constraints scan the whole element tree in _find_field_value, so cost grows faster than linearly with the count. A single request exhausts memory and CPU. The latest release on CPAN is 2.07, from 2018. Version 2.08 exists only in the git repository.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-31T10:16:49.790Z",
  "pubdate": "2026-08-31T10:16:49.790Z",
  "executiveSummary": "HTML::FormFu versions through 2.08 are susceptible to a critical resource exhaustion vulnerability, specifically a Denial of Service (DoS) attack vector. The flaw resides in the handling of 'Repeatable' elements, which fail to validate the upper bounds of a user-supplied repeat count obtained directly from the query string.\nBy manipulating the repeat count parameter, an unauthenticated remote attacker can force the application to perform an unbounded deep-cloning operation of the element's child subtree. Because this occurs during the request processing phase—even for standard GET requests—an attacker can trigger significant CPU and memory consumption without requiring any prior authentication or established session.\nThe vulnerability is amplified when 'Repeatable' elements are nested, as the cloning complexity scales multiplicatively rather than linearly. Furthermore, the submission of a form forces an expensive scan of the entire element tree via _find_field_value, further degrading system performance and leading to resource depletion. This vulnerability poses a severe risk to service availability and system stability, as it allows for trivial exploitation via crafted HTTP requests against any public-facing form utilizing the affected component.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the process method within 'Repeatable' elements in HTML::FormFu. When an element is configured with a counter_name, the component dynamically reads the iteration count from the query string parameters. While the component performs a superficial check to ensure the value is a positive integer, it fails to implement any maximum limit (cap) or configuration directive to restrict the number of iterations.\nThe attack flow begins when an attacker crafts a malicious HTTP GET request containing an arbitrarily large integer for the counter_name parameter. Upon receiving this request, the application initializes the form and enters the process method. The application then invokes the repeat method, which performs a deep-clone operation of the element's entire child subtree for every iteration specified in the request. Because this logic executes before form submission validation, the attack requires no credentials, session tokens, or request bodies, making it highly accessible to external threat actors.\nThe impact of this vulnerability is significantly compounded by nested 'Repeatable' elements. If a nested structure exists (e.g., an inner Repeatable inside an outer Repeatable), the number of clones generated is determined by the product of the counts provided for each level. Providing a value of 100 for both an outer and inner parameter results in 10,000 distinct clones of the child subtree.\nBeyond the initial memory allocation for object cloning, the vulnerability extends to the submission phase. Upon form submission, the _find_field_value function is triggered for each cloned field. This function iterates through the entire element tree for every field present in the submission. The combination of an exponentially large object graph and the non-linear complexity of the tree scanning algorithm leads to extreme CPU utilization and high memory pressure. This resource exhaustion state effectively renders the Perl application unresponsive, resulting in a successful Denial of Service. Affected versions include HTML::FormFu up to version 2.08. Note that version 2.08 is currently only available via the project's git repository, while version 2.07 remains the latest official release on CPAN."
}