CVE-2026-120633: CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, self_url, virtual_host and virtual_port

Q: Which applications are most exposed to this issue?

Applications using affected CGI releases are exposed when they use url, self_url, virtual_host, or virtual_port to generate redirects, links, script URLs, stored URLs, or cacheable responses. The impact is especially relevant where generated URLs are sent to users or shared caches.

Q: What does an attacker need to do to influence generated URLs?

An attacker needs to send a request with an X-Forwarded-Host header containing a host they control. When that header is present, the affected functions use it; otherwise, they use the unvalidated Host header.

Q: Are default CGI-generated locations affected?

Yes. The affected values can become the default redirect location and the base href produced by start_html(-base=>1). They can also affect the default start_form action when REQUEST_URI is not set.

Published Nov 3, 2026

Updated

CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, selfurl, virtualhost and virtualport.

These take the host name and port from the X-Forwarded-Host request header when present, and otherwise from Host, without validating either. The URLs from url and selfurl are the default redirect location and the starthtml(-base=>1) base href, and the default startform action when REQUESTURI is not set.

A client can poison shared caches, and URLs the application stores or sends, with redirects, links and scripts that point at a host it controls.

Affected Software

4 affected components

debian/libcgi-pm-perl*

debian/libcgi-pm-perl<=4.55-1, <=4.68-1, <=4.72-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade CGI for Perl to a version that resolves this vulnerability.
Fixed in 5.00

Event History

Nov 3, 2026

CVE Published

via MITRE·11:40 PM

Data Sourced

via MITRE·11:40 PM

RemedyDescriptionWeakness

Nov 4, 2026

Data Sourced

via NVD·12:17 AM

DescriptionWeakness

Data Sourced

via OSV·12:17 AM

DescriptionAffected Software

Frequently Asked Questions

Which applications are most exposed to this issue?

Applications using affected CGI releases are exposed when they use url, self_url, virtual_host, or virtual_port to generate redirects, links, script URLs, stored URLs, or cacheable responses. The impact is especially relevant where generated URLs are sent to users or shared caches.

What does an attacker need to do to influence generated URLs?

An attacker needs to send a request with an X-Forwarded-Host header containing a host they control. When that header is present, the affected functions use it; otherwise, they use the unvalidated Host header.

Are default CGI-generated locations affected?

Yes. The affected values can become the default redirect location and the base href produced by start_html(-base=>1). They can also affect the default start_form action when REQUEST_URI is not set.

What version addresses the issue?

CGI 5.00 addresses the behavior described. Versions before 5.00 are affected.

CVE-2026-120633: CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, self_url, virtual_host and virtual_port

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are most exposed to this issue?

What does an attacker need to do to influence generated URLs?

Are default CGI-generated locations affected?

What version addresses the issue?

Company

Resources

Contact

Frequently Asked Questions

Which applications are most exposed to this issue?

What does an attacker need to do to influence generated URLs?

Are default CGI-generated locations affected?

What version addresses the issue?