{"id":"CVE-2026-120634","title":"CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer","summary":"CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer.\n\nWarnings are held in a package-level buffer until warningsToBrowser writes them into the page as HTML com…","severity":"none","cwe":["CWE-488"],"product":"CGI","affected":["CGI < 5.00"],"published":"2026-11-03","updated":"2026-11-03","sourceUpdated":"2026-11-03T23:40:08.097Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-120634","references":[{"url":"https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI/Carp.pm"},{"url":"https://metacpan.org/release/LEEJO/CGI-5.00/changes"},{"url":"https://github.com/leejo/CGI.pm/commit/604a83fec105f75fe06f1a75026c4c34fd5a1f61.patch"}],"tags":["cve.org"],"epss":0.00191,"epssPercentile":0.08842,"ingestedAt":"2026-11-05T20:33:06.614Z","slug":"CVE-2026-120634","body":"## Overview\n\nCGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer.\n\nWarnings are held in a package-level buffer until warningsToBrowser writes them into the page as HTML comments, and the buffer is never cleared between requests. Under mod_perl, FastCGI or PSGI, warnings from one request are written into a later one.\n\nWarnings that contain one user's request data can appear in the HTML sent to another user.\n\n## Affected\n\n- `CGI < 5.00`\n\n## Remediation\n\nUpgrade to CGI 5.00 or later.\n\n### Workarounds\n\nFor deployments that cannot upgrade, do not use warningsToBrowser in persistent environments. After upgrading, persistent applications where nothing calls CGI::initialize_globals between requests must also call CGI::Carp::_reset_globals at the start of each request.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}