CVE-2026-120650 CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits

CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size, parameter and upload limits. $CGI::POSTMAX defaults to no limit, and when set is not enforced for chunked multipart bodies or for the boundary line of a multipart body without a boundar...

CVE-2026-120648 CGI versions before 5.00 for Perl allow HTML injection via text containing --> in comment

CGI versions before 5.00 for Perl allow HTML injection via text containing -- in comment. Arguments are placed between without escaping, so text containing -- closes the comment early. An application that passes request data to comment can be made to inject HTML into the page...

CVE-2026-120648

CGI versions before 5.00 for Perl allow HTML injection via text containing -- in comment. Arguments are placed between without escaping, so text containing -- closes the comment early. An application that passes request data to comment can be made to inject HTML into the page...

CVE-2026-120647 CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filename

CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filename. header-attachment = $name writes $name into the quoted filename parameter of Content-Disposition without escaping double quotes. An application that passe...

CVE-2026-120647

CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filename. header-attachment = $name writes $name into the quoted filename parameter of Content-Disposition without escaping double quotes. An application that passe...

CVE-2026-120642 CGI versions before 5.00 for Perl return request-derived values untainted under taint mode

CGI versions before 5.00 for Perl return request-derived values untainted under taint mode. The upload filename, uploadInfo values, some pathinfo and scriptname values, Accept results, and the name lists from urlparam and cookie are returned without the taint flag, as is a cookie named expires fr...

CVE-2026-120641 CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths

CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths. The name returned for an uploaded file is the filename parameter of the part's Content-Disposition header, unchanged. An application that saves the upload under this name can ...

CVE-2026-120641

CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths. The name returned for an uploaded file is the filename parameter of the part's Content-Disposition header, unchanged. An application that saves the upload under this name can ...

CVE-2026-120639

CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipartstart and dopush. With autoEscape off, header decodes HTML entities in extra header values after its newline check, so an encoded CR or LF reaches t...

CVE-2026-120638 CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect

CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect. redirect decodes HTML entities in its URL before writing the Location header, so a URL the application has already validated can change meaning. For example,...

CVE-2026-120638

CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect. redirect decodes HTML entities in its URL before writing the Location header, so a URL the application has already validated can change meaning. For example,...

CVE-2026-120637 CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHOD

CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUESTMETHOD. For a REQUESTMETHOD such as OPTIONS, CGI falls through to its offline debugging mode, which is on by default, and builds the parameters and pathinfo from the...

CVE-2026-120637

CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUESTMETHOD. For a REQUESTMETHOD such as OPTIONS, CGI falls through to its offline debugging mode, which is on by default, and builds the parameters and pathinfo from the...

CVE-2026-120636

CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUESTURI in url and startform. url-absolute=1, url-relative=1 and the default startform action are built from the client-supplied REQUESTURI without validation. The result can be protocol-relative...

CVE-2026-120636 CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_form

CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUESTURI in url and startform. url-absolute=1, url-relative=1 and the default startform action are built from the client-supplied REQUESTURI without validation. The result can be protocol-relative...

CVE-2026-120633 CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, self_url, virtual_host and virtual_port

CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, selfurl, virtualhost and virtualport. These take the host name and port from the X-Forwarded-Host request header when present, and otherwise from Host, without validating either. The URLs from url and selfurl are t...

CVE-2026-120633

CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, selfurl, virtualhost and virtualport. These take the host name and port from the X-Forwarded-Host request header when present, and otherwise from Host, without validating either. The URLs from url and selfurl are t...

CVE-2026-120632 CGI versions before 5.00 for Perl allow CPU exhaustion via a backtracking regex on the XForms multipart/related Content-Type

CGI versions before 5.00 for Perl allow CPU exhaustion via a backtracking regex on the XForms multipart/related Content-Type. When a POST Content-Type contains multipart/related, the boundary and start parameters are extracted with an unanchored pattern that puts .+ on either side of the boundary...

CVE-2026-120632

CGI versions before 5.00 for Perl allow CPU exhaustion via a backtracking regex on the XForms multipart/related Content-Type. When a POST Content-Type contains multipart/related, the boundary and start parameters are extracted with an unanchored pattern that puts .+ on either side of the boundary...