{"id":"CVE-2026-120633","kind":"vulnerability","aliases":["CVE-2026-120633"],"related":[],"title":"Perl CGI: client-supplied X-Forwarded-Host header poisons generated URLs","description":"CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, self_url, virtual_host and virtual_port.\n\nThese take the host name and port from the X-Forwarded-Host request header when present, and otherwise from Host, without validating either. The URLs from url and self_url are the default redirect location and the start_html(-base=>1) base href, and the default start_form action when REQUEST_URI is not set.\n\nA client can poison shared caches, and URLs the application stores or sends, with redirects, links and scripts that point at a host it controls.","summary":"Perl's CGI module before 5.00 builds URLs and redirects from the X-Forwarded-Host or Host request header without checking it. An attacker can make the application send users to a host they control or poison shared caches with links pointing there.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cgi","package","perl","self-hosted"],"not_affected_if":["no-cgi-module","static-urls"],"how_to_check":"- Check the installed CGI version with `perl -MCGI -e 'print $CGI::VERSION'`\n- Find applications that call `url`, `self_url`, `virtual_host` or `start_html(-base=>1)` from the CGI module\n- Check whether a reverse proxy or cache sits in front and keys responses without the Host header","fix":"- CGI (Perl) versions before `5.00` are affected; the sources do not name the fixed release","status":"open","published_at":"2026-11-04T00:17:24+00:00","first_seen_at":"2026-11-04T00:46:16+00:00","triaged_at":"2026-11-04T00:48:24+00:00","updated_at":"2026-11-04T00:48:24+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T00:48:24Z","model":"claude-haiku-5-5","output":{"fix":"- CGI (Perl) versions before `5.00` are affected; the sources do not name the fixed release","reach":"internet","title":"Perl CGI: client-supplied X-Forwarded-Host header poisons generated URLs","impact":"medium","summary":"Perl's CGI module before 5.00 builds URLs and redirects from the X-Forwarded-Host or Host request header without checking it. An attacker can make the application send users to a host they control or poison shared caches with links pointing there.","audience":"developers","category":"package","nicknames":[],"who_cares":["perl","cgi","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Users redirected to attacker host; shared cache serves poisoned links","analyst_note":"Confirm the fixed CGI release and the advisory URL; the sources give only the NVD entry and a patch link.","how_to_check":"- Check the installed CGI version with `perl -MCGI -e 'print $CGI::VERSION'`\n- Find applications that call `url`, `self_url`, `virtual_host` or `start_html(-base=>1)` from the CGI module\n- Check whether a reverse proxy or cache sits in front and keys responses without the Host header","plain_action":"","needs_analyst":true,"not_affected_if":["no-cgi-module","static-urls"],"who_is_affected":"Applications written in Perl that use the CGI module to generate URLs, redirects or forms are exposed when the header is trusted. Behind a cache or proxy the risk rises because poisoned responses can be served to other users. Code that does not use these functions, or that sets REQUEST_URI and validates the host itself, is less exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000733,"input_tokens":4216,"output_tokens":622,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-120633':16A,19A '-2026':15A,18A '1':133C '5.00':31B,72C 'action':141C 'applic':54B,157C 'attack':50B 'base':132C,134C 'build':32B 'cach':65B,153C 'cgi':2A,20B,28B,69C 'check':47B 'client':4A,77C,149C 'client-suppli':3A 'control':61B,172C 'cve':14A,17A 'default':125C,138C 'either':115C 'form':140C 'forward':8A,40B,80C,103C 'generat':12A 'header':10A,45B,82C,106C 'host':9A,25B,41B,43B,59B,81C,88C,95C,104C,112C,170C 'href':135C 'html':131C 'link':67B,163C 'locat':127C 'make':52B 'modul':29B 'name':96C 'otherwis':110C 'packag':21B 'perl':1A,22B,26B,74C 'point':68B,167C 'poison':11A,63B,151C 'port':91C,98C 'present':108C 'redirect':35B,126C,162C 'request':44B,105C,143C 'script':165C 'self':24B,85C,121C 'self-host':23B 'send':55B,160C 'set':147C 'share':64B,152C 'start':130C,139C 'store':158C 'suppli':5A 'take':93C 'trust':75C 'uri':144C 'url':13A,33B,84C,86C,117C,119C,122C,155C 'user':56B 'valid':114C 'version':70C 'virtual':87C,90C 'without':46B,113C 'x':7A,39B,79C,102C 'x-forwarded-host':6A,38B,78C,101C","nicknames":[],"mitigations":[],"who_affected":"Applications written in Perl that use the CGI module to generate URLs, redirects or forms are exposed when the header is trusted. Behind a cache or proxy the risk rises because poisoned responses can be served to other users. Code that does not use these functions, or that sets REQUEST_URI and validates the host itself, is less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cgi","medium","package","perl","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-04T00:17:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120633","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120633","severity":null,"published_at":"2026-11-04T00:17:24+00:00","modified_at":"2026-11-04T00:17:24+00:00","first_seen_at":"2026-11-04T00:46:16+00:00","fetched_at":"2026-11-04T00:46:16+00:00","note":null}],"documents":[{"id":62109,"url":"https://github.com/leejo/CGI.pm/commit/d76752a5e8dfd365b0fe3a0b9a7da6c054e856af.patch","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}