CVE-2026-120634: vulnerability in CGI
CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
0Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Track
CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer.
Warnings are held in a package-level buffer until warningsToBrowser writes them into the page as HTML comments, and the buffer is never cleared between requests. Under mod_perl, FastCGI or PSGI, warnings from one request are written into a later one.
Warnings that contain one user's request data can appear in the HTML sent to another user.
Affected products
CGIRelated CVEs — CGI
In the same product, most dangerous first.
CVE-2026-120651—CGI versions before 5.00 for Perl allow an infinite loop on a short request body when $DISABLE_UPLOADS is setEPSS —CVE-2026-120650—CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limitsEPSS —CVE-2026-120648—CGI versions before 5.00 for Perl allow HTML injection via text containing --> in commentEPSS —CVE-2026-120647—CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filenameEPSS —CVE-2026-120646—CGI versions from 4.71 before 5.00 for Perl allow denial of service via a plain string dereferenced as a symbolic reference in uploadInfoEPSS —CVE-2026-120645—CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrolling_listEPSS —