DEBIAN-CVE-2026-120633: Debian/libcgi-pm-perl vulnerability
CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, selfurl, virtualhost and virtualport. These take the host name and port from the X-Forwarded-Host request header when present, and otherwise from Host, without validating either. The URLs from url and selfurl are the default redirect location and the starthtml(-base=>1) base href, and the default startform action when REQUESTURI is not set. A client can poison shared caches, and URLs the application stores or sends, with redirects, links and scripts that point at a host it controls.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Perl CGIto a version that resolves this vulnerability.Fixed in 5.00
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using affected CGI versions are exposed when they generate URLs through url, self_url, virtual_host, or virtual_port. The impact applies where attacker-controlled Host or X-Forwarded-Host headers can reach the application and generated URLs are redirected, cached, stored, or sent to users.
What does an attacker need to do to exploit it?
An attacker needs to send a request with a malicious X-Forwarded-Host header, or Host header when X-Forwarded-Host is absent. The application must use one of the affected CGI URL helpers in a security-relevant output path such as a redirect, link, script URL, form action, or base href.
Are default-generated application URLs affected?
Yes. url and self_url provide the default redirect location, start_html(-base=>1) uses the generated URL as its base href, and start_form can use it as its default action when REQUEST_URI is not set.
What can be done before patching is available?
Ensure the application or its front-end proxy rejects or overwrites untrusted X-Forwarded-Host and Host headers before requests reach CGI. Configure the trusted proxy layer to supply a validated canonical host rather than allowing client-provided forwarding headers through.