The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-516e427bac advisory.

    5.02 bump
    - Fix CVE-2026-120631 (CGI::Cookie->parse backtracking DoS via cookie expires regex)
    - Fix CVE-2026-120632 (cubic regex backtracking via crafted multipart/related Content-Type)
    - Fix CVE-2026-120650 (missing/unenforced request size, param and upload limits)
    - Fix CVE-2026-120651 (infinite loop reading short PUT/POST/PATCH body with DISABLE_UPLOADS)
    - Fix CVE-2026-120645 (scrolling_list used submitted values as regex for optgroups)
    - Fix CVE-2026-120646 (uploadInfo() dereferenced plain strings as symbolic references)
    - Fix CVE-2026-120639 (header injection via HTML entity decoding in header() extra values)
    - Fix CVE-2026-120644 (CGI::Cookie path/domain/expires not checked; ; injected attributes)
    - Fix CVE-2026-120647 (header() -attachment filename did not escape quotes)
    - Fix CVE-2026-120633 (url()/virtual_host() trusted client-supplied X-Forwarded-Host)
    - Fix CVE-2026-120638 (redirect() HTML-decoded URL after app checked it)
    - Fix CVE-2026-120636 (REQUEST_URI could produce protocol-relative or javascript: URLs)
    - Fix CVE-2026-120643 (url()/self_url() could contain raw single quote via URI->canonical)
    - Fix CVE-2026-120648 (comment() text could end HTML comment)
    - Fix CVE-2026-120634 (CGI::Carp warnings leaked between requests in persistent envs)
    - Fix CVE-2026-120635 (multipart parsing differentials; boundary smuggling)
    - Fix CVE-2026-120641 (upload filenames could contain path; path traversal risk)
    - Fix CVE-2026-120640 (POSTDATA/PUTDATA settable via query string/form field)
    - Fix CVE-2026-120642 (taint mode bypass for upload filename and other values)
    - Fix CVE-2026-120637 (unrecognised REQUEST_METHOD made argv the request params)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a3a026d9ff advisory.

    5.02 bump
    - Fix CVE-2026-120631 (CGI::Cookie->parse backtracking DoS via cookie expires regex)
    - Fix CVE-2026-120632 (cubic regex backtracking via crafted multipart/related Content-Type)
    - Fix CVE-2026-120650 (missing/unenforced request size, param and upload limits)
    - Fix CVE-2026-120651 (infinite loop reading short PUT/POST/PATCH body with DISABLE_UPLOADS)
    - Fix CVE-2026-120645 (scrolling_list used submitted values as regex for optgroups)
    - Fix CVE-2026-120646 (uploadInfo() dereferenced plain strings as symbolic references)
    - Fix CVE-2026-120639 (header injection via HTML entity decoding in header() extra values)
    - Fix CVE-2026-120644 (CGI::Cookie path/domain/expires not checked; ; injected attributes)
    - Fix CVE-2026-120647 (header() -attachment filename did not escape quotes)
    - Fix CVE-2026-120633 (url()/virtual_host() trusted client-supplied X-Forwarded-Host)
    - Fix CVE-2026-120638 (redirect() HTML-decoded URL after app checked it)
    - Fix CVE-2026-120636 (REQUEST_URI could produce protocol-relative or javascript: URLs)
    - Fix CVE-2026-120643 (url()/self_url() could contain raw single quote via URI->canonical)
    - Fix CVE-2026-120648 (comment() text could end HTML comment)
    - Fix CVE-2026-120634 (CGI::Carp warnings leaked between requests in persistent envs)
    - Fix CVE-2026-120635 (multipart parsing differentials; boundary smuggling)
    - Fix CVE-2026-120641 (upload filenames could contain path; path traversal risk)
    - Fix CVE-2026-120640 (POSTDATA/PUTDATA settable via query string/form field)
    - Fix CVE-2026-120642 (taint mode bypass for upload filename and other values)
    - Fix CVE-2026-120637 (unrecognised REQUEST_METHOD made argv the request params)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a04615c725 advisory.

    5.02 bump
    - Fix CVE-2026-120631 (CGI::Cookie->parse backtracking DoS via cookie expires regex)
    - Fix CVE-2026-120632 (cubic regex backtracking via crafted multipart/related Content-Type)
    - Fix CVE-2026-120650 (missing/unenforced request size, param and upload limits)
    - Fix CVE-2026-120651 (infinite loop reading short PUT/POST/PATCH body with DISABLE_UPLOADS)
    - Fix CVE-2026-120645 (scrolling_list used submitted values as regex for optgroups)
    - Fix CVE-2026-120646 (uploadInfo() dereferenced plain strings as symbolic references)
    - Fix CVE-2026-120639 (header injection via HTML entity decoding in header() extra values)
    - Fix CVE-2026-120644 (CGI::Cookie path/domain/expires not checked; ; injected attributes)
    - Fix CVE-2026-120647 (header() -attachment filename did not escape quotes)
    - Fix CVE-2026-120633 (url()/virtual_host() trusted client-supplied X-Forwarded-Host)
    - Fix CVE-2026-120638 (redirect() HTML-decoded URL after app checked it)
    - Fix CVE-2026-120636 (REQUEST_URI could produce protocol-relative or javascript: URLs)
    - Fix CVE-2026-120643 (url()/self_url() could contain raw single quote via URI->canonical)
    - Fix CVE-2026-120648 (comment() text could end HTML comment)
    - Fix CVE-2026-120634 (CGI::Carp warnings leaked between requests in persistent envs)
    - Fix CVE-2026-120635 (multipart parsing differentials; boundary smuggling)
    - Fix CVE-2026-120641 (upload filenames could contain path; path traversal risk)
    - Fix CVE-2026-120640 (POSTDATA/PUTDATA settable via query string/form field)
    - Fix CVE-2026-120642 (taint mode bypass for upload filename and other values)
    - Fix CVE-2026-120637 (unrecognised REQUEST_METHOD made argv the request params)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after     application validation in redirect. redirect decodes HTML entities in its URL before writing the Location     header, so a URL the application has already validated can change meaning. For example,     //evil.example/ becomes //evil.example/ and sends the user to another host. (CVE-2026-120638)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
378029	Fedora 44 : perl-CGI (2026-516e427bac)	Nessus	Fedora Local Security Checks	11/10/2026	11/10/2026	critical
378037	Fedora 43 : perl-CGI (2026-a3a026d9ff)	Nessus	Fedora Local Security Checks	11/10/2026	11/10/2026	critical
378028	Fedora 45 : perl-CGI (2026-a04615c725)	Nessus	Fedora Local Security Checks	11/10/2026	11/10/2026	critical
375710	Linux Distros Unpatched Vulnerability : CVE-2026-120638	Nessus	Misc.	11/4/2026	11/5/2026	medium

Detections

Analytics

Plugins Search

critical

critical

critical

medium