Hi,

The following vulnerability was published for libhtml-formfu-perl.

CVE-2026-19873[0]:
| HTML::FormFu versions through 2.08 for Perl allow resource
| exhaustion via an unbounded repeat count from the query string in
| Repeatable elements.  When a Repeatable element has counter_name
| set, its process method reads the repeat count from the named query
| string parameter, checks only that it is a positive integer, and
| passes it to repeat, which deep-clones the element's child subtree
| once per iteration. Nothing caps the value, and no attribute lets an
| application impose a limit.  The count is read on every request,
| before the form decides whether it was submitted, so a plain GET
| reaches the clone loop with no credentials, no session and no
| request body. Nesting multiplies: a Repeatable inside a Repeatable
| takes a counter at each level, so an outer and an inner value of 100
| build 10,000 clones.  Once the form is submitted, each cloned
| field's constraints scan the whole element tree in
| _find_field_value, so cost grows faster than linearly with the
| count. A single request exhausts memory and CPU.  The latest release
| on CPAN is 2.07, from 2018. Version 2.08 exists only in the git
| repository.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-19873
https://www.cve.org/CVERecord?id=CVE-2026-19873
[1] https://lists.security.metacpan.org/cve-announce/msg/43141785/

Regards,
Salvatore

Hello,

Bug #1146310 in libhtml-formfu-perl reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/perl-team/modules/packages/libhtml-formfu-perl/-/commit/7ee90f546661016e1c3c3472be84ca08a063285c
------------------------------------------------------------------------
Add patch from CPANSec to fix resource exhaustion vulnerability (CVE-2026-19873).

Closes: #1146310
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1146310

We believe that the bug you reported is fixed in the latest version of
libhtml-formfu-perl, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1146310@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
gregor herrmann <gregoa@debian.org> (supplier of updated libhtml-formfu-perl package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 01 Sep 2026 02:31:12 +0200
Source: libhtml-formfu-perl
Architecture: source
Version: 2.07000-3
Distribution: unstable
Urgency: medium
Maintainer: Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org>
Changed-By: gregor herrmann <gregoa@debian.org>
Closes: 1146310
Changes:
 libhtml-formfu-perl (2.07000-3) unstable; urgency=medium
 .
   * Add patch from CPANSec to fix resource exhaustion vulnerability
     (CVE-2026-19873). (Closes: #1146310)
   * Update years of packaging copyright.
   * Declare compliance with Debian Policy 4.7.4.
   * Remove «Rules-Requires-Root: no», which is the current default.
   * Remove «Priority: optional», which is the current default.
   * Convert debian/watch to version 5.
Checksums-Sha1:
 aec9f946a79927c4ccdb0c13aa4eea262127e76b 3651 libhtml-formfu-perl_2.07000-3.dsc
 17bed8352cb68421a2085e64ee3cad9af90e6637 8028 libhtml-formfu-perl_2.07000-3.debian.tar.xz
 d4f5490bd10e7f2f3bdfa36bd58200fac5e505b5 1085580 libhtml-formfu-perl_2.07000-3.git.tar.xz
 f4746552dc8ea11d8a8c86a0e143dfa23f818c81 17724 libhtml-formfu-perl_2.07000-3_source.buildinfo
Checksums-Sha256:
 939f12f9f44465b3e7e6945a9ead9fb74d707ed2ca09690fc0cc563c075d27ea 3651 libhtml-formfu-perl_2.07000-3.dsc
 a1ae3d5b7d2602611a9753c2337cfaddcbf34098e6ebc93f435333bc66575681 8028 libhtml-formfu-perl_2.07000-3.debian.tar.xz
 b6573f9ccba3ddea77f0237edc77d1533a1bf20c7483e93f7c0e197d191b854a 1085580 libhtml-formfu-perl_2.07000-3.git.tar.xz
 10cfb64c0501b77455eebc05fec18eeb92e33ec2367590d55e82dd2abf6d2241 17724 libhtml-formfu-perl_2.07000-3_source.buildinfo
Files:
 75c702a5d59cc25c8be2af60008d519e 3651 perl optional libhtml-formfu-perl_2.07000-3.dsc
 f0bd3a71559669a9d3136db8d9f7180c 8028 perl optional libhtml-formfu-perl_2.07000-3.debian.tar.xz
 4a1fc54672b302ec0f5f4d4a9620790c 1085580 perl None libhtml-formfu-perl_2.07000-3.git.tar.xz
 129ed76b80bb79663641557de881e56b 17724 perl optional libhtml-formfu-perl_2.07000-3_source.buildinfo
Git-Tag-Info: tag=9dc19abcf8b0d988551e3dcb9d4f817a4bac6151 fp=d1e1316e93a760a8104d85fabb3a68018649aa06
Git-Tag-Tagger: gregor herrmann <gregoa@debian.org>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmqWH7cACgkQYG0ITkaD
wHlZ7xAAj58z5umiW/SL2ZDxGSk3QFixPY/vqQJsNxC5aZ2gJ6AbE3zZ1h0uYmcW
aFaS+a6vfHEMGOaLGjUU4QU9JTyKmwxac32ZQGLB0H8iqwe5qGwp4OmoDaBqsWbp
vF9Dt1kAWH/bWnv9QNRCUGl0/5ETi4Wy5KcmrWx8dMCRdaIaR/I+jI2fSM9WkL/f
1SIA9pDouCZOeGGBGF4aCNnv2ZlV3bjlFzOrK4uzgIjajxCkFgkOKMxjPwHYPUL/
BTrYujDq27b6h7QwCuGPc0fkZFVh/W5nwXi06ngO1qUiPWj1PqKn+em1tdbOWj+E
Y+uaaF+Q6IyymnyrXinh9LrgJcnKpba+c2NJSa6LHIO4f44RQpGovSiJVuiKD7J0
zo5Xf+voy5t98YTpp9pSZ2ON8nbg47+QsUivTAit5kxCHlf9gYz1DmN1/kcSZvjy
M3XhtS4o+vnivhBuZfoRFeb36HoqO9JDgXPJLfFBJVqjHaqFat+PgPStQfnu+wdw
3whuGa3+Kd4gRkINHqCDG/GjZbI+JXfk6E3oZWfxIsTAT0urs/d2tbJs/UAsTMJS
kEIt3lSWt3wHK341CIr0Yh4nRsx3+Rkl420S1L8M6kdQ3QbNG9NNVqiarherZBHO
j51wZNxMP9FdcKKSQf9k4xXuNuaCyG9mgtnqYLmRxNwYBFSvx/s=
=/WxF
-----END PGP SIGNATURE-----