DEBIAN-CVE-2026-120639: Debian/libcgi-pm-perl vulnerability
CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipartstart and dopush. With autoEscape off, header decodes HTML entities in extra header values after its newline check, so an encoded CR or LF reaches the response. multipartstart does not check header values for newlines, and dopush does not check the type it prints in each part. An application that passes request data into these header values can be made to add headers or split the response.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Perl CGIto a version that resolves this vulnerability.Fixed in 5.00
Event History
Frequently Asked Questions
Which applications are exposed?
Applications using CGI versions before 5.00 are exposed when they pass request-controlled data into extra response header values, multipart_start header values, or the type printed by do_push. The entity-decoding header path specifically requires autoEscape to be off.
What does an attacker need to exploit this?
An attacker needs control over data that the application places in the affected response header-related values. Encoded carriage-return or line-feed characters can become response newlines after entity decoding, allowing added headers or response splitting.
What can be done before upgrading?
Do not pass request data directly into extra header values, multipart_start header values, or the type used by do_push. Ensure those values cannot contain carriage returns or line feeds, including values that may become newlines after HTML entity decoding.