Live › vulnerability › CVE-2026-120644
CGI::Cookie before 5.00 writes path, domain and expires values into the Set-Cookie header without rejecting semicolons or control characters. An application that fills these values from request data can be tricked into adding other cookie attributes such as Domain or SameSite.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 00:46 UTC. All times on this page are UTC.
Only applications that use CGI::Cookie and set the path, domain or expires values of a cookie from user-controlled request data are exposed. Apps that hard-code those values, or that do not use CGI::Cookie, can skip it.
No product ranges from the sources yet.
perl -MCGI::Cookie -e 'print $CGI::Cookie::VERSION'.CGI::Cookie->new where path, domain or expires come from request parameters.5.00 or later, per the linked patch; exact fixed release unknown beyond that.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values.
The path, domain and expires values are written into the Set-Cookie header without checking for semicolons or control characters.
An application that sets them from request data can be made to add other cookie attributes, such as Domain or SameSite.
This page as .md · .json · in your agent: get_signal("CVE-2026-120644")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.