CVE-2026-120639

Unknown

Description

CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipart_start and do_push. With autoEscape off, header decodes HTML entities in extra header values after its newline check, so an encoded CR or LF reaches the response. multipart_start does not check header values for newlines, and do_push does not check the type it prints in each part. An application that passes request data into these header values can be made to add headers or split the response.

SeverityUnknown

CVSS—

Exploit probability—

ProductCgi

PublishedNov 4, 2026

First seenNov 4, 2026

Weakness typeCWE-113CWE-113

How to fix

Update

CGI5.00 or later

Patches

Vendor advisories

metacpan.org/release/LEEJO/CGI-5.00/changes

Affected products

Product	Affected versions	Fixed in
CGI	v < 5.00	5.00

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.