CVE-2026-120639None▾ SunlitCGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipart_start and do_push. With autoEscape off, header decodes HTML entities in extra header v…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipart_start and do_push.
With autoEscape off, header decodes HTML entities in extra header values after its newline check, so an encoded CR or LF reaches the response. multipart_start does not check header values for newlines, and do_push does not check the type it prints in each part.
An application that passes request data into these header values can be made to add headers or split the response.
CGI < 5.00Upgrade to CGI 5.00 or later.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-120638NoneCGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect
CVE-2026-120650NoneCGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits
CVE-2026-120641NoneCGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths
CVE-2026-120640NoneCGI versions before 5.00 for Perl allow the POSTDATA, PUTDATA, PATCHDATA and XForms:Model parameters to be set from the query string or form fields
CVE-2026-120648NoneCGI versions before 5.00 for Perl allow HTML injection via text containing --> in comment
CVE-2026-120642NoneCGI versions before 5.00 for Perl return request-derived values untainted under taint mode