{"id":"CVE-2026-120634","kind":"vulnerability","aliases":["CVE-2026-120634"],"related":[],"title":"Perl CGI::Carp leaks one user's warnings into another user's page","description":"CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer.\n\nWarnings are held in a package-level buffer until warningsToBrowser writes them into the page as HTML comments, and the buffer is never cleared between requests. Under mod_perl, FastCGI or PSGI, warnings from one request are written into a later one.\n\nWarnings that contain one user's request data can appear in the HTML sent to another user.","summary":"CGI::Carp before 5.00 keeps warnings in a package-level buffer that is never cleared between requests. Under persistent runtimes such as mod_perl, FastCGI or PSGI, warnings containing one user's request data can be written into another user's HTML response.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cgi-carp","fastcgi","mod_perl","package","perl","psgi"],"not_affected_if":["plain-cgi","warningstobrowser-off"],"how_to_check":"- Check the installed CGI::Carp version with `perl -MCGI::Carp -e 'print $CGI::Carp::VERSION'`\n- Look for CGI::Carp use with warningsToBrowser enabled under mod_perl, FastCGI or PSGI","fix":"- Upgrade CGI::Carp to `5.00` or later","status":"open","published_at":"2026-11-04T00:17:24+00:00","first_seen_at":"2026-11-04T00:46:16+00:00","triaged_at":"2026-11-04T00:48:23+00:00","updated_at":"2026-11-04T00:48:23+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T00:48:23Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade CGI::Carp to `5.00` or later\n- unknown whether the sources name any other setting","reach":"internet","title":"Perl CGI::Carp leaks one user's warnings into another user's page","impact":"medium","summary":"CGI::Carp before 5.00 keeps warnings in a package-level buffer that is never cleared between requests. Under persistent runtimes such as mod_perl, FastCGI or PSGI, warnings containing one user's request data can be written into another user's HTML response.","audience":"developers","category":"package","nicknames":[],"who_cares":["perl","cgi-carp","mod_perl","fastcgi","psgi"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"one user's request data appears in another user's page","analyst_note":"","how_to_check":"- Check the installed CGI::Carp version with `perl -MCGI::Carp -e 'print $CGI::Carp::VERSION'`\n- Look for CGI::Carp use with warningsToBrowser enabled under mod_perl, FastCGI or PSGI\n- unknown whether the sources give any other check","plain_action":"","needs_analyst":false,"not_affected_if":["plain-cgi","warningstobrowser-off"],"who_is_affected":"Applications that load CGI::Carp in a persistent Perl environment (mod_perl, FastCGI or PSGI) with warningsToBrowser turned on can leak warning text between users. Plain CGI deployments, where each request starts a new process, are not described as affected. Teams that do not use warningsToBrowser can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000717,"input_tokens":4183,"output_tokens":597,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-120634':16A,19A '-2026':15A,18A '5.00':32B,77C 'across':82C 'anoth':10A,68B,149C 'appear':143C 'buffer':40B,90C,99C,112C 'carp':3A,22B,30B,74C 'cgi':2A,21B,29B,73C 'cgi-carp':20B 'clear':44B,115C 'comment':109C 'contain':58B,136C 'cve':14A,17A 'data':63B,141C 'environ':86C 'fastcgi':23B,54B,121C 'held':93C 'html':71B,108C,146C 'keep':33B 'later':132C 'leak':4A,80C 'level':39B,98C 'mod':24B,52B,119C 'never':43B,114C 'one':5A,59B,126C,133C,137C 'packag':26B,38B,97C 'package-level':37B,96C 'page':13A,106C 'perl':1A,25B,27B,53B,79C,120C 'persist':48B,85C 'psgi':28B,56B,123C 'request':46B,62B,83C,117C,127C,140C 'respons':72B 'runtim':49B 'sent':147C 'user':6A,11A,60B,69B,138C,150C 'version':75C 'via':87C 'warn':8A,34B,57B,81C,91C,124C,134C 'warningstobrows':89C,101C 'write':102C 'written':66B,129C","nicknames":[],"mitigations":[],"who_affected":"Applications that load CGI::Carp in a persistent Perl environment (mod_perl, FastCGI or PSGI) with warningsToBrowser turned on can leak warning text between users. Plain CGI deployments, where each request starts a new process, are not described as affected. Teams that do not use warningsToBrowser can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cgicarp","fastcgi","modperl","package","perl","psgi","unknown"],"campaign_type":null,"first_public_at":"2026-11-04T00:17:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120634","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120634","severity":null,"published_at":"2026-11-04T00:17:24+00:00","modified_at":"2026-11-04T00:17:24+00:00","first_seen_at":"2026-11-04T00:46:16+00:00","fetched_at":"2026-11-04T00:46:16+00:00","note":null}],"documents":[{"id":62110,"url":"https://github.com/leejo/CGI.pm/commit/604a83fec105f75fe06f1a75026c4c34fd5a1f61.patch","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}