https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 12:35:50 +0000 https://vulnerability.circl.lu/vuln/cve-2022-4993 <p><strong>Affected:</strong> HTML-FormHandler</p> <p>HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template.</p> <p>add_error hands its first argument to the language handle as the Locale::Maketext message key, and the default handle&#39;s lexicon sets `_AUTO`, so a string that is not a lexicon entry is compiled as a bracket notation template instead of being looked up. In a bracket group the first token names a method called on the language handle and the remaining tokens are its arguments.</p> <p>Three kinds of text the library did not author reach that position. _apply_actions installs a `$SIG{__WARN__}` handler that stores the warning text in `$error_message`, and a captured warning survives a successful action, so a field carrying a numeric transform turns `Argument &#34;[sprintf,%50000000d,0]&#34; isn&#39;t numeric` into the template; a warning quotes the submitted value verbatim, so the group is well formed and dispatches. `$error_message ||= $tobj-&gt;validate($new_value)` takes a type constraint&#39;s own failure message, which renders the rejected value through a partial dumper in bracket and comma form (Devel::PartialDump when Moose can load it, Type::Tiny&#39;s own dumper always), so a field with `apply =&gt; [ Str ]` given a parameter sent more than once, which arrives as an array, gets `Reference [&#34;a&#34;,&#34;b&#34;] did not pass type constraint &#34;Str&#34;` as its template, from a…</p> <p><strong>Affected:</strong> HTML-FormHandler</p> <p>HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template.</p> <p>add_error hands its first argument to the language handle as the Locale::Maketext message key, and the default handle&#39;s lexicon sets `_AUTO`, so a string that is not a lexicon entry is compiled as a bracket notation template instead of being looked up. In a bracket group the first token names a method called on the language handle and the remaining tokens are its arguments.</p> <p>Three kinds of text the library did not author reach that position. _apply_actions installs a `$SIG{__WARN__}` handler that stores the warning text in `$error_message`, and a captured warning survives a successful action, so a field carrying a numeric transform turns `Argument &#34;[sprintf,%50000000d,0]&#34; isn&#39;t numeric` into the template; a warning quotes the submitted value verbatim, so the group is well formed and dispatches. `$error_message ||= $tobj-&gt;validate($new_value)` takes a type constraint&#39;s own failure message, which renders the rejected value through a partial dumper in bracket and comma form (Devel::PartialDump when Moose can load it, Type::Tiny&#39;s own dumper always), so a field with `apply =&gt; [ Str ]` given a parameter sent more than once, which arrives as an array, gets `Reference [&#34;a&#34;,&#34;b&#34;] did not pass type constraint &#34;Str&#34;` as its template, from a…</p> https://vulnerability.circl.lu/vuln/cve-2022-4993