Log in Start free

Vulnerability · Published Nov 3, 2026 · Assigned by CPANSec

CVE-2026-120635CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs

Unrated

In plain English

A security flaw in CGI. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS )–Not rated
Exploit odds (30 days)0.2%top 90.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs. The multipart/form-data parser matches the boundary anywhere rather than at the start of a line, uses the boundary without its leading -- for some client-supplied User-Agent values, finds the Content-Disposition name and filename inside the quoted values of other parameters, and corrupts parts when the boundary nears the 4096-byte read size.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libcgi-pm-perlno fix listedDEBIAN-CVE-2026-120635
Debian:13libcgi-pm-perlno fix listedDEBIAN-CVE-2026-120635
Debian:14libcgi-pm-perlno fix listedDEBIAN-CVE-2026-120635
Ubuntu:22.04:LTSlibcgi-pm-perlno fix listedUBUNTU-CVE-2026-120635
Ubuntu:24.04:LTSlibcgi-pm-perlno fix listedUBUNTU-CVE-2026-120635
Ubuntu:26.04:LTSlibcgi-pm-perlno fix listedUBUNTU-CVE-2026-120635
Ubuntu:26.10libcgi-pm-perlno fix listedUBUNTU-CVE-2026-120635

Affected products (as reported)

VendorProductVersions
CGI 0 – before 5.00

Weakness: CWE-436

References