CVE-2026-120637: CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHOD

Q: Which deployments are exposed?

Deployments using Perl CGI versions before 5.00 are affected when they process a request with an unrecognised REQUEST_METHOD, such as OPTIONS. The affected behavior is the module's offline debugging mode, which is enabled by default.

Q: What does an attacker need to trigger the issue?

An attacker needs to cause the CGI code to handle an unrecognised REQUEST_METHOD. For example, OPTIONS is identified as a method that causes the module to enter the affected fallback path.

Q: What is the recommended remediation?

Upgrade the Perl CGI module to version 5.00 or later. Versions before 5.00 contain the affected request-method fallback behavior.

Published Nov 3, 2026

Updated

CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUESTMETHOD.

For a REQUESTMETHOD such as OPTIONS, CGI falls through to its offline debugging mode, which is on by default, and builds the parameters and pathinfo from the process's command line arguments.

Affected Software

4 affected components

debian/libcgi-pm-perl*

debian/libcgi-pm-perl<=4.55-1, <=4.68-1, <=4.72-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Perl CGI to a version that resolves this vulnerability.
Fixed in 5.00

Event History

Nov 3, 2026

CVE Published

via MITRE·11:40 PM

Data Sourced

via MITRE·11:40 PM

RemedyDescriptionWeakness

Nov 4, 2026

Data Sourced

via NVD·12:17 AM

DescriptionWeakness

Data Sourced

via OSV·12:17 AM

DescriptionAffected Software

Frequently Asked Questions

Which deployments are exposed?

Deployments using Perl CGI versions before 5.00 are affected when they process a request with an unrecognised REQUEST_METHOD, such as OPTIONS. The affected behavior is the module's offline debugging mode, which is enabled by default.

What does an attacker need to trigger the issue?

An attacker needs to cause the CGI code to handle an unrecognised REQUEST_METHOD. For example, OPTIONS is identified as a method that causes the module to enter the affected fallback path.

What is the recommended remediation?

Upgrade the Perl CGI module to version 5.00 or later. Versions before 5.00 contain the affected request-method fallback behavior.

CVE-2026-120637: CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHOD

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to trigger the issue?

What is the recommended remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to trigger the issue?

What is the recommended remediation?