The Mojolicious module before 9.11 for Perl has a bug in format detection that can potentially be exploited for denial of service.
{ "urgency": "not yet assigned" }