Live › vulnerability › CVE-2026-120635
The Perl CGI module before 5.00 parses multipart form data differently from the HTTP standards, so a crafted request can hide form fields from a proxy or web application firewall. An attacker can use this to get past filtering that checks request bodies, and the exact impact on a given app depends on what that filtering protects.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 00:46 UTC. All times on this page are UTC.
Applications written in Perl that use the CGI module to read multipart/form-data uploads or forms are exposed, especially those behind a WAF or proxy that relies on request inspection. Apps that do not parse multipart bodies with this module, or that have no inspection layer in front, can skip it. Whether a specific deployment is exploitable has not been confirmed from the sources.
No product ranges from the sources yet.
perl -MCGI -e 'print $CGI::VERSION'5.00 or later (per the advisory's stated range; the linked patch pages were not read)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs.
The multipart/form-data parser matches the boundary anywhere rather than at the start of a line, uses the boundary without its leading -- for some client-supplied User-Agent values, finds the Content-Disposition name and filename inside the quoted values of other parameters, and corrupts parts when the boundary nears the 4096-byte read size.
This page as .md · .json · in your agent: get_signal("CVE-2026-120635")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.