An unauthenticated resource exhaustion vulnerability in the HTML::FormFu Perl module allows attackers to crash services via excessive memory and CPU consumption.

This is a resource exhaustion vulnerability (CWE-770) caused by improper validation of input quantities. An unauthenticated attacker can manipulate the query string to force the application to perform recursive cloning of element subtrees, leading to a denial of service.

The ability for an unauthenticated attacker to exhaust memory and CPU resources poses a significant risk to application availability. A successful exploit can lead to service outages and system instability, impacting business operations. With a CVSS score of 7.5, this high-severity flaw requires immediate attention to prevent potential service disruptions.

Immediate Action: Since no official patched release is currently available, administrators must manually apply the provided security patch available at the referenced Metacpan security page.

Proactive Monitoring: Monitor server logs and resource utilization metrics for sudden spikes in memory or CPU usage that correlate with incoming GET requests containing unusually high repeat parameters.

Compensating Controls: Implement Web Application Firewall (WAF) rules to inspect and filter incoming query strings, specifically blocking or limiting the values allowed for Repeatable element counter parameters.

Public Exploit Available: Unknown.

Given the lack of a formal release, organizations utilizing HTML::FormFu must prioritize the manual application of the published patch. Security teams should verify their environment for the presence of the vulnerable library and apply the fix immediately to neutralize this high-risk denial of service vector.