CVE-2026-120639

    Dashboard / Vulnerabilities / CVE-2026-120639

    CVE-2026-120639

    Published: 3 Nov 2026Last Modified: 7 Nov 2026

    Summary: CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipart_start and do_push

    Details: CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipart_start and do_push. With autoEscape off, header decodes HTML entities in extra header values after its newline check, so an encoded CR or LF reaches the response. multipart_start does not check header values for newlines, and do_push does not check the type it prints in each part. An application that passes request data into these header values can be made to add headers or split the response.

    References: https://cpan.org/modules, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/120xxx/CVE-2026-120639.json, https://metacpan.org/release/LEEJO/CGI-5.00/changes, https://nvd.nist.gov/vuln/detail/CVE-2026-120639, https://github.com/leejo/CGI.pm/commit/69955309d371c8093d11cf12e3ddef491537ffad.patch, https://github.com/leejo/CGI.pm/commit/7733c2753f4f240012097507cda2b6e87ae46db4.patch, https://github.com/leejo/CGI.pm, https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -69955309d371c8093d11cf12e3ddef491537ffad

    Affected versions

    v4.72

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-120639 | CVE-DB