DEBIAN-CVE-2026-120634: Debian/libcgi-pm-perl vulnerability
CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer. Warnings are held in a package-level buffer until warningsToBrowser writes them into the page as HTML comments, and the buffer is never cleared between requests. Under modperl, FastCGI or PSGI, warnings from one request are written into a later one. Warnings that contain one user's request data can appear in the HTML sent to another user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CGI::Carpto a version that resolves this vulnerability.Fixed in 5.00
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using CGI::Carp before version 5.00 in persistent Perl application environments are exposed. The affected persistent environments identified are mod_perl, FastCGI, and PSGI.
What conditions are required for data to be disclosed to another user?
Warnings must be accumulated in the package-level warningsToBrowser buffer during one request, and a later request must cause warningsToBrowser to write that buffer into the response. Warning text containing request data can then be emitted as HTML comments in the later user's page.
How can an administrator determine whether an application may already be affected?
Check whether the application uses CGI::Carp before 5.00 with warningsToBrowser enabled in a mod_perl, FastCGI, or PSGI deployment. Review generated HTML comments and application warning output for warning messages that reference data from a different request or user.