Live › vulnerability › CVE-2026-120637
CGI versions before 5.00 for Perl, when given an unrecognised REQUEST_METHOD such as OPTIONS, fall back to offline debugging mode and build request parameters from the process command line. The sources do not state a direct attacker impact beyond that parameter source being wrong.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 00:46 UTC. All times on this page are UTC.
Applications that use the Perl CGI module to parse incoming web requests, particularly those that accept unusual REQUEST_METHOD values. Systems that do not run Perl CGI scripts can skip it. The sources do not say how an attacker would use the command line parameters.
No product ranges from the sources yet.
perl -MCGI -e 'print $CGI::VERSION'5.00 or later, per the linked patchEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHOD.
For a REQUEST_METHOD such as OPTIONS, CGI falls through to its offline debugging mode, which is on by default, and builds the parameters and path_info from the process's command line arguments.
This page as .md · .json · in your agent: get_signal("CVE-2026-120637")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.