Log in Start free

Vulnerability · Published Nov 3, 2026 · Assigned by CPANSec

CVE-2026-120634CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer

Unrated

In plain English

A security flaw in CGI. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS )–Not rated
Exploit odds (30 days)0.2%top 91.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer. Warnings are held in a package-level buffer until warningsToBrowser writes them into the page as HTML comments, and the buffer is never cleared between requests. Under mod_perl, FastCGI or PSGI, warnings from one request are written into a later one. Warnings that contain one user's request data can appear in the HTML sent to another user.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libcgi-pm-perlno fix listedDEBIAN-CVE-2026-120634
Debian:13libcgi-pm-perlno fix listedDEBIAN-CVE-2026-120634
Debian:14libcgi-pm-perlno fix listedDEBIAN-CVE-2026-120634
Ubuntu:22.04:LTSlibcgi-pm-perlno fix listedUBUNTU-CVE-2026-120634
Ubuntu:24.04:LTSlibcgi-pm-perlno fix listedUBUNTU-CVE-2026-120634
Ubuntu:26.04:LTSlibcgi-pm-perlno fix listedUBUNTU-CVE-2026-120634
Ubuntu:26.10libcgi-pm-perlno fix listedUBUNTU-CVE-2026-120634

Affected products (as reported)

VendorProductVersions
CGI 0 – before 5.00

Weakness: CWE-488

References