[SECURITY] Fedora 43 Update: perl-CGI-5.02-1.fc43

CGI.pm is a stable, complete and mature solution for processing and preparing HTTP requests and responses. Major features including processing form submissions, file uploads, reading and writing cookies, query string generation and manipulation, and processing and preparing HTTP headers. Some HTM...

[SECURITY] Fedora 44 Update: perl-CGI-5.02-1.fc44

CGI.pm is a stable, complete and mature solution for processing and preparing HTTP requests and responses. Major features including processing form submissions, file uploads, reading and writing cookies, query string generation and manipulation, and processing and preparing HTTP headers. Some HTM...

[SECURITY] Fedora 45 Update: perl-CGI-5.02-1.fc45

CGI.pm is a stable, complete and mature solution for processing and preparing HTTP requests and responses. Major features including processing form submissions, file uploads, reading and writing cookies, query string generation and manipulation, and processing and preparing HTTP headers. Some HTM...

CVE-2026-120648

A flaw was found in perl-CGI. When generating HTML comments, input is placed directly into comment tags without proper escaping. A remote attacker could exploit this flaw by submitting input that prematurely terminates the comment block, enabling the injection of arbitrary HTML or client-side...

CVE-2026-120647

A flaw was found in perl-cgi. A remote attacker can manipulate the filename of downloaded files by providing input containing unescaped double quotes to applications that use untrusted data for attachment names in HTTP Hypertext Transfer Protocol responses. Because the module does not properly...

CVE-2026-120645

A flaw was found in perl-cgi. When rendering option groups using the scrollinglist function, user-supplied input from request parameters is directly inserted into regular expression search patterns without proper escaping. A remote attacker can exploit this vulnerability by submitting crafted inp...

CVE-2026-120644

A flaw was found in perl-cgi. This vulnerability allows a remote attacker to inject arbitrary cookie attributes into HTTP Hypertext Transfer Protocol Set-Cookie response headers. The issue occurs because the module fails to properly validate semicolons or control characters in path, domain, and...

CVE-2026-120640

A flaw was found in perl-cgi. This vulnerability allows a remote attacker to conduct request forgery by spoofing internal request body parameters through query strings or form fields. Because the module does not distinguish between actual request payloads and user-supplied parameters, an attacker...

CVE-2026-120638

A flaw was found in perl-cgi. The redirect function decodes HTML entities in target URLs before generating the HTTP Location header. A remote attacker could exploit this vulnerability by supplying a specially crafted URL containing encoded characters that bypasses application-level URL validation...

CVE-2026-120639

A flaw was found in perl-cgi, where it fails to properly validate newline characters when generating HTTP headers. When an application passes untrusted input into header fields, entity-encoded newlines or unvalidated parameters can bypass sanitization checks. A remote attacker could exploit this...

CVE-2026-120637

A flaw was found in perl-cgi. When processing an unrecognized HTTP request method, such as OPTIONS, the module unintentionally falls back into its default offline debugging mode. A remote attacker can exploit this issue by submitting a request with an unhandled method to force the application to...

CVE-2026-120636

A flaw was found in perl-cgi. The component constructs target URLs and form actions from client-supplied request values without sufficient validation. A remote attacker can exploit this flaw by sending a specially crafted request URI Uniform Resource Identifier containing arbitrary domains or...

CVE-2026-120635

A flaw was found in perl-CGI. Due to discrepancies in how multipart form-data requests are parsed compared to standard specifications, a remote attacker can smuggle form fields past intermediate proxies and Web Application Firewalls WAFs. By submitting specially crafted multipart requests, an...

CVE-2026-120634

A flaw was found in perl-cgi. When running in persistent server environments, the internal buffer used to forward warnings to the browser is not cleared between requests. Consequently, a user can view sensitive request data or error details from another user's session in the returned HTML comment...

CVE-2026-120643

A flaw was found in perl-CGI. When constructing Uniform Resource Locators URLs, the url and selfurl functions fail to properly encode single quote characters in request paths or query parameters. A remote attacker can exploit this issue by submitting a crafted request to an application that embed...

CVE-2026-120633

A flaw was found in perl-CGI. This vulnerability allows a remote attacker to conduct web cache poisoning or redirect users to malicious websites by sending crafted Hypertext Transfer Protocol HTTP requests with untrusted host headers. Because the module trusts client-provided headers such as...

CVE-2026-120642

A flaw was found in perl-cgi. When running under Perl's taint mode—a security feature that prevents untrusted data from being used in sensitive operations—the module returns several request-derived values without taint flags. A remote attacker could exploit this vulnerability by submitting crafte...

CVE-2026-120641

A flaw was found in perl-cgi. The module returns client-supplied upload filenames without sanitizing directory traversal sequences or path separators. A remote attacker can exploit this flaw by submitting a file upload with a crafted filename, potentially causing the host application to write fil...

CVE-2026-120651

A flaw was found in perl-cgi. A remote attacker can trigger a denial of service DoS by sending an HTTP request containing a body shorter than its declared Content-Length header. When file upload processing is disabled, the server enters an infinite loop attempting to discard remaining data,...

CVE-2026-120650

A flaw was found in perl-cgi. A remote attacker can trigger a Denial of Service DoS through excessive memory, processor, and disk space consumption by sending specially crafted HTTP requests. Due to missing or unenforced limits on request sizes, parameters, and file uploads, the module processes...