CVE-2026-19873: CWE-1284 Improper Validation of Specified Quantity in Input

CVE-2026-19873 affects HTML::FormFu versions through 2.08 and involves improper validation of a specified quantity in input (CWE-1284). When a Repeatable element has a counter_name set, its process method reads the repeat count from a query string parameter, validating only that it is a positive integer without any upper bound. This count is used to deep-clone the element's child subtree repeatedly, potentially creating a very large number of clones. Nested Repeatable elements multiply the cloning effect, causing exponential growth in resource consumption. The cloning occurs on every request before form submission is determined, allowing unauthenticated GET requests to trigger resource exhaustion. The latest official release on CPAN is 2.07, with version 2.08 only available in the git repository. No official patch or remediation is currently documented.

An attacker can cause a denial of service by exhausting server memory and CPU resources through crafted requests that specify large repeat counts in query parameters. This can degrade or disrupt service availability. There is no impact on confidentiality or integrity reported. The vulnerability can be exploited without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory or repository for current remediation guidance. Since no official patch or fix is documented, users should consider implementing application-level limits on repeat counts or avoid using Repeatable elements with untrusted input until a fix is available.