DEBIAN-CVE-2026-120644: Debian/libcgi-pm-perl vulnerability
CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values. The path, domain and expires values are written into the Set-Cookie header without checking for semicolons or control characters. An application that sets them from request data can be made to add other cookie attributes, such as Domain or SameSite.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CGI::Cookieto a version that resolves this vulnerability.Fixed in 5.00
Event History
Frequently Asked Questions
Which applications are realistically exposed to this issue?
Applications using CGI::Cookie before version 5.00 are exposed when they populate a cookie's path, domain, or expires attribute from request-controlled data. Applications that only use fixed, trusted values for those attributes are not described as exploitable by the available information.
What does an attacker need to exploit it?
An attacker needs a way to influence an application's cookie path, domain, or expires value. Supplying semicolons or control characters in one of those values can cause additional cookie attributes to be written into the Set-Cookie header.
What can be done if upgrading is not immediately possible?
Do not pass request-derived values directly to CGI::Cookie for path, domain, or expires. Validate or reject values containing semicolons or control characters, and use fixed trusted values where possible.