---
id: "CVE-2026-120639"
kind: "vulnerability"
aliases: ["CVE-2026-120639"]
title: "Perl CGI: header injection through entity decoding and multipart output"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cgi.pm", "package", "perl", "self-hosted"]
not_affected_if: ["autoescape-on", "no-user-input-in-headers"]
published_at: "2026-11-04T00:17:25+00:00"
first_seen_at: "2026-11-04T00:46:16+00:00"
updated_at: "2026-11-04T00:48:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120639", "first_seen_at": "2026-11-04T00:46:16+00:00"}]
---

# Perl CGI: header injection through entity decoding and multipart output

CGI.pm for Perl before version 5.00 decodes HTML entities in header values after its newline check, so an encoded line break can reach the response. An attacker who controls values passed into these headers can add headers or split the HTTP response.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Find the installed CGI.pm version with `perl -MCGI -e 'print $CGI::VERSION'`
- Search application code for calls to `header`, `multipart_start` or `do_push` that receive request data
- Check whether `autoEscape` is turned off in the application

## Fix

- Upgrade CGI.pm to `5.00` or later (per the NVD description: versions before 5.00 are affected)

## Timeline

- 2026-11-04T00:46:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120639

## Documents

- [fix] Patch: github.com https://github.com/leejo/CGI.pm/commit/69955309d371c8093d11cf12e3ddef491537ffad.patch
- [fix] Patch: github.com https://github.com/leejo/CGI.pm/commit/7733c2753f4f240012097507cda2b6e87ae46db4.patch

## From the sources

CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipart_start and do_push.

With autoEscape off, header decodes HTML entities in extra header values after its newline check, so an encoded CR or LF reaches the response. multipart_start does not check header values for newlines, and do_push does not check the type it prints in each part.

An application that passes request data into these header values can be made to add headers or split the response.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_