{"id":"CVE-2026-120639","kind":"vulnerability","aliases":["CVE-2026-120639"],"related":[],"title":"Perl CGI: header injection through entity decoding and multipart output","description":"CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipart_start and do_push.\n\nWith autoEscape off, header decodes HTML entities in extra header values after its newline check, so an encoded CR or LF reaches the response. multipart_start does not check header values for newlines, and do_push does not check the type it prints in each part.\n\nAn application that passes request data into these header values can be made to add headers or split the response.","summary":"CGI.pm for Perl before version 5.00 decodes HTML entities in header values after its newline check, so an encoded line break can reach the response. An attacker who controls values passed into these headers can add headers or split the HTTP response.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cgi.pm","package","perl","self-hosted"],"not_affected_if":["autoescape-on","no-user-input-in-headers"],"how_to_check":"- Find the installed CGI.pm version with `perl -MCGI -e 'print $CGI::VERSION'`\n- Search application code for calls to `header`, `multipart_start` or `do_push` that receive request data\n- Check whether `autoEscape` is turned off in the application","fix":"- Upgrade CGI.pm to `5.00` or later (per the NVD description: versions before 5.00 are affected)","status":"open","published_at":"2026-11-04T00:17:25+00:00","first_seen_at":"2026-11-04T00:46:16+00:00","triaged_at":"2026-11-04T00:48:17+00:00","updated_at":"2026-11-04T00:48:17+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T00:48:17Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade CGI.pm to `5.00` or later (per the NVD description: versions before 5.00 are affected)","reach":"internet","title":"Perl CGI: header injection through entity decoding and multipart output","impact":"medium","summary":"CGI.pm for Perl before version 5.00 decodes HTML entities in header values after its newline check, so an encoded line break can reach the response. An attacker who controls values passed into these headers can add headers or split the HTTP response.","audience":"developers","category":"package","nicknames":[],"who_cares":["perl","cgi.pm","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker injects headers or splits the HTTP response","analyst_note":"Confirm the affected version range and fixed release from the linked patch commits on github.com, and check whether autoEscape default changes the exposure.","how_to_check":"- Find the installed CGI.pm version with `perl -MCGI -e 'print $CGI::VERSION'`\n- Search application code for calls to `header`, `multipart_start` or `do_push` that receive request data\n- Check whether `autoEscape` is turned off in the application","plain_action":"","needs_analyst":true,"not_affected_if":["no-user-input-in-headers","autoescape-on"],"who_is_affected":"Applications written in Perl that use CGI.pm and pass request data into response header values, multipart_start, or do_push. With autoEscape off, header decodes entities after its newline check, which is the path the flaw uses. Applications that do not pass user input into these functions are less exposed, and the sources do not say more.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00072,"input_tokens":4195,"output_tokens":601,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-120639':13A,16A '-2026':12A,15A '5.00':28B,68C 'add':58B,153C 'allow':71C 'applic':140C 'attack':49B 'autoescap':94C 'break':43B 'cgi':2A,65C 'cgi.pm':17B,23B 'check':38B,81C,107C,121C,131C 'control':51B 'cr':111C 'cve':11A,14A 'data':144C 'decod':7A,29B,77C,97C 'encod':41B,110C 'entiti':6A,31B,76C,99C 'extra':101C 'header':3A,33B,56B,59B,73C,83C,96C,102C,122C,147C,154C 'host':22B 'html':30B,98C 'http':63B,72C 'inject':4A,74C 'lf':113C 'line':42B 'made':151C 'multipart':9A,88C,117C 'newlin':37B,80C,106C,125C 'output':10A 'packag':18B 'part':138C 'pass':53B,142C 'perl':1A,19B,25B,70C 'print':135C 'push':92C,128C 'reach':45B,114C 'request':143C 'respons':47B,64B,116C,158C 'self':21B 'self-host':20B 'split':61B,156C 'start':89C,118C 'type':133C 'uncheck':85C 'valu':34B,52B,86C,103C,123C,148C 'version':27B,66C 'via':75C","nicknames":[],"mitigations":[],"who_affected":"Applications written in Perl that use CGI.pm and pass request data into response header values, multipart_start, or do_push. With autoEscape off, header decodes entities after its newline check, which is the path the flaw uses. Applications that do not pass user input into these functions are less exposed, and the sources do not say more.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cgipm","medium","package","perl","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-04T00:17:25+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120639","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120639","severity":null,"published_at":"2026-11-04T00:17:25+00:00","modified_at":"2026-11-04T00:17:25+00:00","first_seen_at":"2026-11-04T00:46:16+00:00","fetched_at":"2026-11-04T00:46:16+00:00","note":null}],"documents":[{"id":62118,"url":"https://github.com/leejo/CGI.pm/commit/69955309d371c8093d11cf12e3ddef491537ffad.patch","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":62117,"url":"https://github.com/leejo/CGI.pm/commit/7733c2753f4f240012097507cda2b6e87ae46db4.patch","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}