CVE-2026-120639: CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipart_start and do_push

Q: Which applications are exposed to this issue?

Applications using CGI versions before 5.00 are exposed if they pass request-controlled data into extra header values, multipart_start header values, or the type printed by do_push. The header entity-decoding path specifically requires autoEscape to be off.

Q: What input does an attacker need to exploit the vulnerability?

An attacker needs control over data that the application supplies to the affected response-header-related values. For the header path with autoEscape disabled, encoded carriage-return or line-feed HTML entities can be decoded after the newline validation and reach the HTTP response.

Q: What is the impact of successful exploitation?

An attacker can add HTTP response headers or split the HTTP response. This occurs when unchecked or post-validation-decoded newline characters reach emitted header values.

Q: How can I determine whether my application is affected?

Check whether it uses CGI earlier than 5.00 and whether request-derived values are passed to header extra values, multipart_start header values, or do_push type values. Also check whether autoEscape is disabled for uses of header with extra header values.

Published Nov 3, 2026

Updated

CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipartstart and dopush.

With autoEscape off, header decodes HTML entities in extra header values after its newline check, so an encoded CR or LF reaches the response. multipartstart does not check header values for newlines, and dopush does not check the type it prints in each part.

An application that passes request data into these header values can be made to add headers or split the response.

Affected Software

4 affected components

debian/libcgi-pm-perl*

debian/libcgi-pm-perl<=4.55-1, <=4.68-1, <=4.72-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade CGI for Perl to a version that resolves this vulnerability.
Fixed in 5.00

Event History

Nov 3, 2026

CVE Published

via MITRE·11:40 PM

Data Sourced

via MITRE·11:40 PM

RemedyDescriptionWeakness

Data Sourced

via OSV·11:40 PM

DescriptionWeakness

Nov 4, 2026

Data Sourced

via NVD·12:17 AM

DescriptionWeakness

Data Sourced

via OSV·12:17 AM

Affected Software

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using CGI versions before 5.00 are exposed if they pass request-controlled data into extra header values, multipart_start header values, or the type printed by do_push. The header entity-decoding path specifically requires autoEscape to be off.

What input does an attacker need to exploit the vulnerability?

An attacker needs control over data that the application supplies to the affected response-header-related values. For the header path with autoEscape disabled, encoded carriage-return or line-feed HTML entities can be decoded after the newline validation and reach the HTTP response.

What is the impact of successful exploitation?

An attacker can add HTTP response headers or split the HTTP response. This occurs when unchecked or post-validation-decoded newline characters reach emitted header values.

How can I determine whether my application is affected?

Check whether it uses CGI earlier than 5.00 and whether request-derived values are passed to header extra values, multipart_start header values, or do_push type values. Also check whether autoEscape is disabled for uses of header with extra header values.

CVE-2026-120639: CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipart_start and do_push

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What input does an attacker need to exploit the vulnerability?

What is the impact of successful exploitation?

How can I determine whether my application is affected?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What input does an attacker need to exploit the vulnerability?

What is the impact of successful exploitation?

How can I determine whether my application is affected?