DEBIAN-CVE-2026-120637: Debian/libcgi-pm-perl vulnerability

Published Nov 4, 2026

Updated

CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUESTMETHOD. For a REQUESTMETHOD such as OPTIONS, CGI falls through to its offline debugging mode, which is on by default, and builds the parameters and pathinfo from the process's command line arguments.

Affected Software

3 affected components

debian/libcgi-pm-perl*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Perl CGI to a version that resolves this vulnerability.
Fixed in 5.00

Event History

Nov 4, 2026

CVE Published

via OSV·12:17 AM

Data Sourced

via OSV·12:17 AM

DescriptionAffected Software

Frequently Asked Questions

Which deployments are exposed to this behavior?

Deployments using CGI versions before 5.00 for Perl may be exposed when they handle an unrecognised REQUEST_METHOD, such as OPTIONS. The affected package identified here is debian/libcgi-pm-perl.

What does an attacker need to trigger the issue?

An attacker needs to cause the CGI application to receive an unrecognised REQUEST_METHOD. With a method such as OPTIONS, CGI enters its offline debugging mode and derives parameters and path_info from the process command-line arguments.

Is a non-default setting required?

No. The offline debugging mode involved in this behavior is enabled by default.