Log in Start free

Vulnerability · Published Nov 3, 2026 · Assigned by CPANSec

CVE-2026-120633CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, self_url, virtual_host and virtual_port

Unrated

In plain English

A open redirect in CGI. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS )–Not rated
Exploit odds (30 days)0.1%top 97.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, self_url, virtual_host and virtual_port. These take the host name and port from the X-Forwarded-Host request header when present, and otherwise from Host, without validating either. The URLs from url and self_url are the default redirect location and the start_html(-base=>1) base href, and the default start_form action when REQUEST_URI is not set. A client can poison shared caches, and URLs the application stores or sends, with redirects, links and scripts that point at a host it controls.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libcgi-pm-perlno fix listedDEBIAN-CVE-2026-120633
Debian:13libcgi-pm-perlno fix listedDEBIAN-CVE-2026-120633
Debian:14libcgi-pm-perlno fix listedDEBIAN-CVE-2026-120633
Ubuntu:22.04:LTSlibcgi-pm-perlno fix listedUBUNTU-CVE-2026-120633
Ubuntu:24.04:LTSlibcgi-pm-perlno fix listedUBUNTU-CVE-2026-120633
Ubuntu:26.04:LTSlibcgi-pm-perlno fix listedUBUNTU-CVE-2026-120633
Ubuntu:26.10libcgi-pm-perlno fix listedUBUNTU-CVE-2026-120633

Affected products (as reported)

VendorProductVersions
CGI 0 – before 5.00

Weakness: CWE-348, CWE-601

References