CVE-2026-120639

The perl-cgi component (versions before 5.00 ) is vulnerable to HTTP header injection and HTTP response splitting . The root cause is that when autoEscape is off, the header function decodes HTML entities after performing newline checks, allowing encoded CR or LF characters to reach the response....