CVE-2026-120639

The perl-cgi component (versions before 5.00 ) is vulnerable to HTTP header injection and HTTP response splitting . The root cause is that when autoEscape is off, the header function decodes HTML entities after performing newline checks, allowing encoded CR or LF characters to reach the response....

CVE-2026-120639 CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipart_start and do_push

CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipartstart and dopush. With autoEscape off, header decodes HTML entities in extra header values after its newline check, so an encoded CR or LF reaches t...