---
id: "CVE-2026-120633"
kind: "vulnerability"
aliases: ["CVE-2026-120633"]
title: "Perl CGI: client-supplied X-Forwarded-Host header poisons generated URLs"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cgi", "package", "perl", "self-hosted"]
not_affected_if: ["no-cgi-module", "static-urls"]
published_at: "2026-11-04T00:17:24+00:00"
first_seen_at: "2026-11-04T00:46:16+00:00"
updated_at: "2026-11-04T00:48:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120633", "first_seen_at": "2026-11-04T00:46:16+00:00"}]
---

# Perl CGI: client-supplied X-Forwarded-Host header poisons generated URLs

Perl's CGI module before 5.00 builds URLs and redirects from the X-Forwarded-Host or Host request header without checking it. An attacker can make the application send users to a host they control or poison shared caches with links pointing there.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed CGI version with `perl -MCGI -e 'print $CGI::VERSION'`
- Find applications that call `url`, `self_url`, `virtual_host` or `start_html(-base=>1)` from the CGI module
- Check whether a reverse proxy or cache sits in front and keys responses without the Host header

## Fix

- CGI (Perl) versions before `5.00` are affected; the sources do not name the fixed release

## Timeline

- 2026-11-04T00:46:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120633

## Documents

- [fix] Patch: github.com https://github.com/leejo/CGI.pm/commit/d76752a5e8dfd365b0fe3a0b9a7da6c054e856af.patch

## From the sources

CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, self_url, virtual_host and virtual_port.

These take the host name and port from the X-Forwarded-Host request header when present, and otherwise from Host, without validating either. The URLs from url and self_url are the default redirect location and the start_html(-base=>1) base href, and the default start_form action when REQUEST_URI is not set.

A client can poison shared caches, and URLs the application stores or sends, with redirects, links and scripts that point at a host it controls.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_