Live › vulnerability › CVE-2026-120634
CGI::Carp before 5.00 keeps warnings in a package-level buffer that is never cleared between requests. Under persistent runtimes such as mod_perl, FastCGI or PSGI, warnings containing one user's request data can be written into another user's HTML response.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 00:46 UTC. All times on this page are UTC.
Applications that load CGI::Carp in a persistent Perl environment (mod_perl, FastCGI or PSGI) with warningsToBrowser turned on can leak warning text between users. Plain CGI deployments, where each request starts a new process, are not described as affected. Teams that do not use warningsToBrowser can skip it.
No product ranges from the sources yet.
perl -MCGI::Carp -e 'print $CGI::Carp::VERSION'5.00 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer.
Warnings are held in a package-level buffer until warningsToBrowser writes them into the page as HTML comments, and the buffer is never cleared between requests. Under mod_perl, FastCGI or PSGI, warnings from one request are written into a later one.
Warnings that contain one user's request data can appear in the HTML sent to another user.
This page as .md · .json · in your agent: get_signal("CVE-2026-120634")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.