CVE-2026-120644: CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values

Q: What applications are realistically exposed to this issue?

Applications using CGI::Cookie before 5.00 are exposed when they populate a cookie's path, domain, or expires attribute from request-controlled data. Applications that use only fixed, trusted values for those attributes are not described as exploitable by the provided information.

Q: What does an attacker need to exploit it?

An attacker needs a way to influence the path, domain, or expires value used by the application when creating a cookie. The supplied value must reach CGI::Cookie without application-side validation that rejects semicolons or control characters.

Q: What is the impact of successful exploitation?

An attacker can inject additional cookie attributes into the Set-Cookie header. The described examples include adding attributes such as Domain or SameSite.

Q: What can be done if upgrading is not immediately possible?

Do not derive cookie path, domain, or expires values from request data. Where such input is necessary, validate it before passing it to CGI::Cookie and reject semicolons and control characters.

Published Nov 3, 2026

Updated

CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values.

The path, domain and expires values are written into the Set-Cookie header without checking for semicolons or control characters.

An application that sets them from request data can be made to add other cookie attributes, such as Domain or SameSite.

Affected Software

4 affected components

debian/libcgi-pm-perl*

debian/libcgi-pm-perl<=4.55-1, <=4.68-1, <=4.72-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade CGI::Cookie to a version that resolves this vulnerability.
Fixed in 5.00

Event History

Nov 3, 2026

CVE Published

via MITRE·11:40 PM

Data Sourced

via MITRE·11:40 PM

RemedyDescriptionWeakness

Nov 4, 2026

Data Sourced

via NVD·12:17 AM

DescriptionWeakness

Data Sourced

via OSV·12:17 AM

DescriptionAffected Software

Frequently Asked Questions

What applications are realistically exposed to this issue?

Applications using CGI::Cookie before 5.00 are exposed when they populate a cookie's path, domain, or expires attribute from request-controlled data. Applications that use only fixed, trusted values for those attributes are not described as exploitable by the provided information.

What does an attacker need to exploit it?

An attacker needs a way to influence the path, domain, or expires value used by the application when creating a cookie. The supplied value must reach CGI::Cookie without application-side validation that rejects semicolons or control characters.

What is the impact of successful exploitation?

An attacker can inject additional cookie attributes into the Set-Cookie header. The described examples include adding attributes such as Domain or SameSite.

What can be done if upgrading is not immediately possible?

Do not derive cookie path, domain, or expires values from request data. Where such input is necessary, validate it before passing it to CGI::Cookie and reject semicolons and control characters.

CVE-2026-120644: CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values

Affected Software

Remediation

Event History

Frequently Asked Questions

What applications are realistically exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

What applications are realistically exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

What can be done if upgrading is not immediately possible?