PerlRun.pm in Apache mod_perl before 1.30 and RegistryCooker.pm in mod_perl 2.x does not properly escape PATH_INFO before use in a regular expression which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.