CVE-2026-120634: CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer

Q: Which deployments are exposed to cross-request warning leakage?

Deployments using CGI::Carp before 5.00 in persistent Perl environments are exposed, specifically mod_perl, FastCGI, or PSGI. The issue depends on requests sharing a process where the package-level warningsToBrowser buffer persists.

Q: What conditions are required for one user to receive another user's data?

A warning containing data from one request must be placed in the warningsToBrowser buffer, and a later request must cause warningsToBrowser to write that retained buffer into its response. The leaked warning content is emitted as HTML comments.

Q: Are ordinary non-persistent CGI deployments affected?

The described cross-request leakage is tied to persistent environments where the buffer is not cleared between requests. The provided information identifies mod_perl, FastCGI, and PSGI as affected deployment types.

Q: How can administrators determine whether they may be affected?

Check whether the application uses CGI::Carp before version 5.00 and runs under mod_perl, FastCGI, or PSGI. Also determine whether warningsToBrowser is used, since it writes the retained warnings into generated pages.

Published Nov 3, 2026

Updated

CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer.

Warnings are held in a package-level buffer until warningsToBrowser writes them into the page as HTML comments, and the buffer is never cleared between requests. Under modperl, FastCGI or PSGI, warnings from one request are written into a later one.

Warnings that contain one user's request data can appear in the HTML sent to another user.

Affected Software

4 affected components

debian/libcgi-pm-perl*

debian/libcgi-pm-perl<=4.55-1, <=4.68-1, <=4.72-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade CGI::Carp to a version that resolves this vulnerability.
Fixed in 5.00

Event History

Nov 3, 2026

CVE Published

via MITRE·11:40 PM

Data Sourced

via MITRE·11:40 PM

RemedyDescriptionWeakness

Nov 4, 2026

Data Sourced

via NVD·12:17 AM

DescriptionWeakness

Data Sourced

via OSV·12:17 AM

DescriptionAffected Software

Frequently Asked Questions

Which deployments are exposed to cross-request warning leakage?

Deployments using CGI::Carp before 5.00 in persistent Perl environments are exposed, specifically mod_perl, FastCGI, or PSGI. The issue depends on requests sharing a process where the package-level warningsToBrowser buffer persists.

What conditions are required for one user to receive another user's data?

A warning containing data from one request must be placed in the warningsToBrowser buffer, and a later request must cause warningsToBrowser to write that retained buffer into its response. The leaked warning content is emitted as HTML comments.

Are ordinary non-persistent CGI deployments affected?

The described cross-request leakage is tied to persistent environments where the buffer is not cleared between requests. The provided information identifies mod_perl, FastCGI, and PSGI as affected deployment types.

How can administrators determine whether they may be affected?

Check whether the application uses CGI::Carp before version 5.00 and runs under mod_perl, FastCGI, or PSGI. Also determine whether warningsToBrowser is used, since it writes the retained warnings into generated pages.

CVE-2026-120634: CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to cross-request warning leakage?

What conditions are required for one user to receive another user's data?

Are ordinary non-persistent CGI deployments affected?

How can administrators determine whether they may be affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to cross-request warning leakage?

What conditions are required for one user to receive another user's data?

Are ordinary non-persistent CGI deployments affected?

How can administrators determine whether they may be affected?