Live › vulnerability › CVE-2026-120633
Perl's CGI module before 5.00 builds URLs and redirects from the X-Forwarded-Host or Host request header without checking it. An attacker can make the application send users to a host they control or poison shared caches with links pointing there.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 00:46 UTC. All times on this page are UTC.
Applications written in Perl that use the CGI module to generate URLs, redirects or forms are exposed when the header is trusted. Behind a cache or proxy the risk rises because poisoned responses can be served to other users. Code that does not use these functions, or that sets REQUEST_URI and validates the host itself, is less exposed.
No product ranges from the sources yet.
perl -MCGI -e 'print $CGI::VERSION'url, self_url, virtual_host or start_html(-base=>1) from the CGI module5.00 are affected; the sources do not name the fixed releaseEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, self_url, virtual_host and virtual_port.
These take the host name and port from the X-Forwarded-Host request header when present, and otherwise from Host, without validating either. The URLs from url and self_url are the default redirect location and the start_html(-base=>1) base href, and the default start_form action when REQUEST_URI is not set.
A client can poison shared caches, and URLs the application stores or sends, with redirects, links and scripts that point at a host it controls.
This page as .md · .json · in your agent: get_signal("CVE-2026-120633")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.