DEBIAN-CVE-2026-120635: Debian/libcgi-pm-perl vulnerability
CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs. The multipart/form-data parser matches the boundary anywhere rather than at the start of a line, uses the boundary without its leading -- for some client-supplied User-Agent values, finds the Content-Disposition name and filename inside the quoted values of other parameters, and corrupts parts when the boundary nears the 4096-byte read size.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Perl CGIto a version that resolves this vulnerability.Fixed in 5.00
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using the CGI multipart/form-data parser in versions before 5.00 are exposed when they accept multipart form submissions. Deployments that rely on a proxy or WAF to inspect those submissions are particularly affected because the parser can interpret fields differently from those controls.
What does an attacker need to exploit it?
An attacker needs to submit a crafted multipart/form-data request. The request can use malformed or ambiguous boundary placement, certain client-supplied User-Agent behavior, quoted parameter values, or boundary placement near the 4096-byte read size to cause parsing differences or corruption.
How can I determine whether a deployment is affected?
Check whether the application uses the CGI multipart/form-data parser and whether its CGI version is earlier than 5.00. Also review whether multipart requests pass through a proxy or WAF whose inspection decisions could differ from the application's parser.