I'm not using fastcgi, just the standard cgi caller, and it's spawning multiple perl processes because the "attacker" will make multiple calls, and since the perl process is hung, the old ones will never die, eventually leading into an out of memory condition.

I guess I misworded it, lighttpd itself isn't spawning new perl processes, but the old ones won't expire so every call to kareha with that malformed string creates a new perl process that hangs.