Live › vulnerability › CVE-2026-120639
CGI.pm for Perl before version 5.00 decodes HTML entities in header values after its newline check, so an encoded line break can reach the response. An attacker who controls values passed into these headers can add headers or split the HTTP response.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 00:46 UTC. All times on this page are UTC.
Applications written in Perl that use CGI.pm and pass request data into response header values, multipart_start, or do_push. With autoEscape off, header decodes entities after its newline check, which is the path the flaw uses. Applications that do not pass user input into these functions are less exposed, and the sources do not say more.
No product ranges from the sources yet.
perl -MCGI -e 'print $CGI::VERSION'header, multipart_start or do_push that receive request dataautoEscape is turned off in the application5.00Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipart_start and do_push.
With autoEscape off, header decodes HTML entities in extra header values after its newline check, so an encoded CR or LF reaches the response. multipart_start does not check header values for newlines, and do_push does not check the type it prints in each part.
An application that passes request data into these header values can be made to add headers or split the response.
This page as .md · .json · in your agent: get_signal("CVE-2026-120639")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.