It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3436 advisory.

    CGI::Cookie versions from 4.67 before 5.00 for Perl allow denial of service via the client cookie expires     value used as a regex in parse.

    CGI's cookie method reads the Cookie request header through parse, which interpolates the header's expires     value unescaped into the substitution pattern that removes it from the cookie string.

    A client can make the request die with an invalid pattern, or tie up the process with one that backtracks     catastrophically. (CVE-2026-120631)

    CGI versions before 5.00 for Perl allow CPU exhaustion via a backtracking regex on the XForms     multipart/related Content-Type.

    When a POST Content-Type contains multipart/related, the boundary and start parameters are extracted with     an unanchored pattern that puts .+ on either side of the boundary capture, which backtracks in cubic time     on a header that does not match. No request body is needed. (CVE-2026-120632)

    CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, self_url, virtual_host     and virtual_port.

    These take the host name and port from the X-Forwarded-Host request header when present, and otherwise     from Host, without validating either. The URLs from url and self_url are the default redirect location and     the start_html(-base=>1) base href, and the default start_form action when REQUEST_URI is not set.

    A client can poison shared caches, and URLs the application stores or sends, with redirects, links and     scripts that point at a host it controls. (CVE-2026-120633)

    CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the     warningsToBrowser buffer.

    Warnings are held in a package-level buffer until warningsToBrowser writes them into the page as HTML     comments, and the buffer is never cleared between requests. Under mod_perl, FastCGI or PSGI, warnings from     one request are written into a later one.

    Warnings that contain one user's request data can appear in the HTML sent to another user.
    (CVE-2026-120634)

    CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart     parsing that differs from the RFCs.

    The multipart/form-data parser matches the boundary anywhere rather than at the start of a line, uses the     boundary without its leading -- for some client-supplied User-Agent values, finds the Content-Disposition     name and filename inside the quoted values of other parameters, and corrupts parts when the boundary nears     the 4096-byte read size. (CVE-2026-120635)

    CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from     REQUEST_URI in url and start_form.

    url(-absolute=>1), url(-relative=>1) and the default start_form action are built from the client-supplied     REQUEST_URI without validation. The result can be protocol-relative (//evil.example), absolute-form     (http://evil.example/) or contain backslashes, and url(-relative=>1) can return a javascript: URL. Links     and form posts built from these URLs can go to another host. (CVE-2026-120636)

    CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an     unrecognised REQUEST_METHOD.

    For a REQUEST_METHOD such as OPTIONS, CGI falls through to its offline debugging mode, which is on by     default, and builds the parameters and path_info from the process's command line arguments.
    (CVE-2026-120637)

    CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after     application validation in redirect.

    redirect decodes HTML entities in its URL before writing the Location header, so a URL the application has     already validated can change meaning. For example, //evil.example/ becomes //evil.example/ and sends     the user to another host. (CVE-2026-120638)

    CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check     in header and unchecked values in multipart_start and do_push.

    With autoEscape off, header decodes HTML entities in extra header values after its newline check, so an     encoded CR or LF reaches the response. multipart_start does not check header values for newlines, and     do_push does not check the type it prints in each part.

    An application that passes request data into these header values can be made to add headers or split the     response. (CVE-2026-120639)

    CGI versions before 5.00 for Perl allow the POSTDATA, PUTDATA, PATCHDATA and XForms:Model parameters to be     set from the query string or form fields.

    CGI stores a non-form request body under POSTDATA, PUTDATA or PATCHDATA, and an XForms body under     XForms:Model, but also accepts these names from the query string, a form field or a multipart part, so an     application cannot tell a client-sent value from the real body.

    A cross-site HTML form can post POSTDATA={admin:true} to an endpoint that reads JSON from     param('POSTDATA'), a request forgery that needs no CORS preflight. (CVE-2026-120640)

    CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and     Windows paths.

    The name returned for an uploaded file is the filename parameter of the part's Content-Disposition header,     unchanged.

    An application that saves the upload under this name can be made to write outside the intended directory.
    (CVE-2026-120641)

    CGI versions before 5.00 for Perl return request-derived values untainted under taint mode.

    The upload filename, uploadInfo values, some path_info and script_name values, Accept results, and the     name lists from url_param and cookie are returned without the taint flag, as is a cookie named expires     from 4.67 on.

    These values come from regex captures or hash keys, which Perl does not taint, so they pass -T checks     unvalidated. (CVE-2026-120642)

    CGI versions from 4.62 before 5.00 for Perl allow cross-site scripting via a raw apostrophe in URLs     returned by url and self_url.

    Both pass the URL through URI's canonical method, which leaves an apostrophe in the path raw and decodes     the %27 that query parameter escaping produces, so an apostrophe in the request path or a parameter     appears raw in the result.

    An application that places the URL in a single-quoted HTML attribute or JavaScript string is open to     cross-site scripting. (CVE-2026-120643)

    CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain     and expires values.

    The path, domain and expires values are written into the Set-Cookie header without checking for semicolons     or control characters.

    An application that sets them from request data can be made to add other cookie attributes, such as Domain     or SameSite. (CVE-2026-120644)

    CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for     optgroup selection in scrolling_list.

    When rendering option groups, scrolling_list marks the selected options by interpolating each selected     value, by default taken from the request parameters, unescaped into a substitution pattern.

    A client can make the request die with an invalid pattern, or tie up the process with one that backtracks     heavily. (CVE-2026-120645)

    CGI versions from 4.71 before 5.00 for Perl allow denial of service via a plain string dereferenced as a     symbolic reference in uploadInfo.

    uploadInfo dereferences its argument and calls its filename method without checking that it is an upload     filehandle. A plain string naming a defined global variable, such as the parameter value from ?upload=0,     is treated as a symbolic reference, and the method call on it dies. (CVE-2026-120646)

    CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double     quotes in the header attachment filename.

    header(-attachment => $name) writes $name into the quoted filename parameter of Content-Disposition     without escaping double quotes.

    An application that passes request data as the attachment name can be made to send a second filename     parameter, changing the name the response is saved under. (CVE-2026-120647)

    CGI versions before 5.00 for Perl allow HTML injection via text containing --> in comment.

    Arguments are placed between  without escaping, so text containing --> closes the comment     early.

    An application that passes request data to comment can be made to inject HTML into the page.
    (CVE-2026-120648)

    CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request     size, parameter and upload limits.

    $CGI::POST_MAX defaults to no limit, and when set is not enforced for chunked multipart bodies or for the     boundary line of a multipart body without a boundary= parameter. Bodies saved as PUTDATA, POSTDATA or     PATCHDATA uploads are read into memory in one go, and nothing limits the number of parameters or uploads.
    (CVE-2026-120650)

    CGI versions before 5.00 for Perl allow an infinite loop on a short request body when $DISABLE_UPLOADS is     set.

    When $CGI::PUTDATA_UPLOAD or an upload hook is set, read_postdata_putdata takes a request body that is not     a form submission. With $CGI::DISABLE_UPLOADS set, it discards the body by reading until Content-Length     bytes have arrived. Once a body shorter than its Content-Length runs out, every read returns 0, so the     loop never ends.

    A client can keep a server process spinning with one such request. (CVE-2026-120651)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a04615c725 advisory.

    5.02 bump
    - Fix CVE-2026-120631 (CGI::Cookie->parse backtracking DoS via cookie expires regex)
    - Fix CVE-2026-120632 (cubic regex backtracking via crafted multipart/related Content-Type)
    - Fix CVE-2026-120650 (missing/unenforced request size, param and upload limits)
    - Fix CVE-2026-120651 (infinite loop reading short PUT/POST/PATCH body with DISABLE_UPLOADS)
    - Fix CVE-2026-120645 (scrolling_list used submitted values as regex for optgroups)
    - Fix CVE-2026-120646 (uploadInfo() dereferenced plain strings as symbolic references)
    - Fix CVE-2026-120639 (header injection via HTML entity decoding in header() extra values)
    - Fix CVE-2026-120644 (CGI::Cookie path/domain/expires not checked; ; injected attributes)
    - Fix CVE-2026-120647 (header() -attachment filename did not escape quotes)
    - Fix CVE-2026-120633 (url()/virtual_host() trusted client-supplied X-Forwarded-Host)
    - Fix CVE-2026-120638 (redirect() HTML-decoded URL after app checked it)
    - Fix CVE-2026-120636 (REQUEST_URI could produce protocol-relative or javascript: URLs)
    - Fix CVE-2026-120643 (url()/self_url() could contain raw single quote via URI->canonical)
    - Fix CVE-2026-120648 (comment() text could end HTML comment)
    - Fix CVE-2026-120634 (CGI::Carp warnings leaked between requests in persistent envs)
    - Fix CVE-2026-120635 (multipart parsing differentials; boundary smuggling)
    - Fix CVE-2026-120641 (upload filenames could contain path; path traversal risk)
    - Fix CVE-2026-120640 (POSTDATA/PUTDATA settable via query string/form field)
    - Fix CVE-2026-120642 (taint mode bypass for upload filename and other values)
    - Fix CVE-2026-120637 (unrecognised REQUEST_METHOD made argv the request params)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain     and expires values. The path, domain and expires values are written into the Set-Cookie header without     checking for semicolons or control characters. An application that sets them from request data can be made     to add other cookie attributes, such as Domain or SameSite. (CVE-2026-120644)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-516e427bac advisory.

    5.02 bump
    - Fix CVE-2026-120631 (CGI::Cookie->parse backtracking DoS via cookie expires regex)
    - Fix CVE-2026-120632 (cubic regex backtracking via crafted multipart/related Content-Type)
    - Fix CVE-2026-120650 (missing/unenforced request size, param and upload limits)
    - Fix CVE-2026-120651 (infinite loop reading short PUT/POST/PATCH body with DISABLE_UPLOADS)
    - Fix CVE-2026-120645 (scrolling_list used submitted values as regex for optgroups)
    - Fix CVE-2026-120646 (uploadInfo() dereferenced plain strings as symbolic references)
    - Fix CVE-2026-120639 (header injection via HTML entity decoding in header() extra values)
    - Fix CVE-2026-120644 (CGI::Cookie path/domain/expires not checked; ; injected attributes)
    - Fix CVE-2026-120647 (header() -attachment filename did not escape quotes)
    - Fix CVE-2026-120633 (url()/virtual_host() trusted client-supplied X-Forwarded-Host)
    - Fix CVE-2026-120638 (redirect() HTML-decoded URL after app checked it)
    - Fix CVE-2026-120636 (REQUEST_URI could produce protocol-relative or javascript: URLs)
    - Fix CVE-2026-120643 (url()/self_url() could contain raw single quote via URI->canonical)
    - Fix CVE-2026-120648 (comment() text could end HTML comment)
    - Fix CVE-2026-120634 (CGI::Carp warnings leaked between requests in persistent envs)
    - Fix CVE-2026-120635 (multipart parsing differentials; boundary smuggling)
    - Fix CVE-2026-120641 (upload filenames could contain path; path traversal risk)
    - Fix CVE-2026-120640 (POSTDATA/PUTDATA settable via query string/form field)
    - Fix CVE-2026-120642 (taint mode bypass for upload filename and other values)
    - Fix CVE-2026-120637 (unrecognised REQUEST_METHOD made argv the request params)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a3a026d9ff advisory.

    5.02 bump
    - Fix CVE-2026-120631 (CGI::Cookie->parse backtracking DoS via cookie expires regex)
    - Fix CVE-2026-120632 (cubic regex backtracking via crafted multipart/related Content-Type)
    - Fix CVE-2026-120650 (missing/unenforced request size, param and upload limits)
    - Fix CVE-2026-120651 (infinite loop reading short PUT/POST/PATCH body with DISABLE_UPLOADS)
    - Fix CVE-2026-120645 (scrolling_list used submitted values as regex for optgroups)
    - Fix CVE-2026-120646 (uploadInfo() dereferenced plain strings as symbolic references)
    - Fix CVE-2026-120639 (header injection via HTML entity decoding in header() extra values)
    - Fix CVE-2026-120644 (CGI::Cookie path/domain/expires not checked; ; injected attributes)
    - Fix CVE-2026-120647 (header() -attachment filename did not escape quotes)
    - Fix CVE-2026-120633 (url()/virtual_host() trusted client-supplied X-Forwarded-Host)
    - Fix CVE-2026-120638 (redirect() HTML-decoded URL after app checked it)
    - Fix CVE-2026-120636 (REQUEST_URI could produce protocol-relative or javascript: URLs)
    - Fix CVE-2026-120643 (url()/self_url() could contain raw single quote via URI->canonical)
    - Fix CVE-2026-120648 (comment() text could end HTML comment)
    - Fix CVE-2026-120634 (CGI::Carp warnings leaked between requests in persistent envs)
    - Fix CVE-2026-120635 (multipart parsing differentials; boundary smuggling)
    - Fix CVE-2026-120641 (upload filenames could contain path; path traversal risk)
    - Fix CVE-2026-120640 (POSTDATA/PUTDATA settable via query string/form field)
    - Fix CVE-2026-120642 (taint mode bypass for upload filename and other values)
    - Fix CVE-2026-120637 (unrecognised REQUEST_METHOD made argv the request params)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
379830	Amazon Linux 2023 : perl-CGI, perl-CGI-tests (ALAS2023-2026-3436)	Nessus	Amazon Linux Local Security Checks	11/12/2026	11/12/2026	critical
378028	Fedora 45 : perl-CGI (2026-a04615c725)	Nessus	Fedora Local Security Checks	11/10/2026	11/10/2026	critical
375689	Linux Distros Unpatched Vulnerability : CVE-2026-120644	Nessus	Misc.	11/4/2026	11/10/2026	critical
378029	Fedora 44 : perl-CGI (2026-516e427bac)	Nessus	Fedora Local Security Checks	11/10/2026	11/10/2026	critical
378037	Fedora 43 : perl-CGI (2026-a3a026d9ff)	Nessus	Fedora Local Security Checks	11/10/2026	11/10/2026	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical