Looking through the code of CGI.pm, when you call header(), it calls self_or_default(). That particular function is a rather ugly way of allowing a procedural and object-oriented interface.

Anyhow, self_or_default() winds up calling CGI::new() if you're using the procedural interface. This is important, because new() calls init(). As I predicted earlier, that's what calls sysread. It slurps up $ENV{'CONTENT_LENGTH'} worth of bytes from STDIN.

When you attempt to read from STDIN, there's nothing there. So Perl helpfully waits for something -- anything -- which never arrives.

As for Vars() versus param(), Vars() is an old, deprecated, backwards-compatible function that bridges the gap between Perl 4 functionality and Perl 5. param() is the wave of the future! It's worth learning; it's flexible and powerful.