The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for     optgroup selection in scrolling_list. When rendering option groups, scrolling_list marks the selected     options by interpolating each selected value, by default taken from the request parameters, unescaped into     a substitution pattern. A client can make the request die with an invalid pattern, or tie up the process     with one that backtracks heavily. (CVE-2026-120645)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-516e427bac advisory.

    5.02 bump
    - Fix CVE-2026-120631 (CGI::Cookie->parse backtracking DoS via cookie expires regex)
    - Fix CVE-2026-120632 (cubic regex backtracking via crafted multipart/related Content-Type)
    - Fix CVE-2026-120650 (missing/unenforced request size, param and upload limits)
    - Fix CVE-2026-120651 (infinite loop reading short PUT/POST/PATCH body with DISABLE_UPLOADS)
    - Fix CVE-2026-120645 (scrolling_list used submitted values as regex for optgroups)
    - Fix CVE-2026-120646 (uploadInfo() dereferenced plain strings as symbolic references)
    - Fix CVE-2026-120639 (header injection via HTML entity decoding in header() extra values)
    - Fix CVE-2026-120644 (CGI::Cookie path/domain/expires not checked; ; injected attributes)
    - Fix CVE-2026-120647 (header() -attachment filename did not escape quotes)
    - Fix CVE-2026-120633 (url()/virtual_host() trusted client-supplied X-Forwarded-Host)
    - Fix CVE-2026-120638 (redirect() HTML-decoded URL after app checked it)
    - Fix CVE-2026-120636 (REQUEST_URI could produce protocol-relative or javascript: URLs)
    - Fix CVE-2026-120643 (url()/self_url() could contain raw single quote via URI->canonical)
    - Fix CVE-2026-120648 (comment() text could end HTML comment)
    - Fix CVE-2026-120634 (CGI::Carp warnings leaked between requests in persistent envs)
    - Fix CVE-2026-120635 (multipart parsing differentials; boundary smuggling)
    - Fix CVE-2026-120641 (upload filenames could contain path; path traversal risk)
    - Fix CVE-2026-120640 (POSTDATA/PUTDATA settable via query string/form field)
    - Fix CVE-2026-120642 (taint mode bypass for upload filename and other values)
    - Fix CVE-2026-120637 (unrecognised REQUEST_METHOD made argv the request params)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a3a026d9ff advisory.

    5.02 bump
    - Fix CVE-2026-120631 (CGI::Cookie->parse backtracking DoS via cookie expires regex)
    - Fix CVE-2026-120632 (cubic regex backtracking via crafted multipart/related Content-Type)
    - Fix CVE-2026-120650 (missing/unenforced request size, param and upload limits)
    - Fix CVE-2026-120651 (infinite loop reading short PUT/POST/PATCH body with DISABLE_UPLOADS)
    - Fix CVE-2026-120645 (scrolling_list used submitted values as regex for optgroups)
    - Fix CVE-2026-120646 (uploadInfo() dereferenced plain strings as symbolic references)
    - Fix CVE-2026-120639 (header injection via HTML entity decoding in header() extra values)
    - Fix CVE-2026-120644 (CGI::Cookie path/domain/expires not checked; ; injected attributes)
    - Fix CVE-2026-120647 (header() -attachment filename did not escape quotes)
    - Fix CVE-2026-120633 (url()/virtual_host() trusted client-supplied X-Forwarded-Host)
    - Fix CVE-2026-120638 (redirect() HTML-decoded URL after app checked it)
    - Fix CVE-2026-120636 (REQUEST_URI could produce protocol-relative or javascript: URLs)
    - Fix CVE-2026-120643 (url()/self_url() could contain raw single quote via URI->canonical)
    - Fix CVE-2026-120648 (comment() text could end HTML comment)
    - Fix CVE-2026-120634 (CGI::Carp warnings leaked between requests in persistent envs)
    - Fix CVE-2026-120635 (multipart parsing differentials; boundary smuggling)
    - Fix CVE-2026-120641 (upload filenames could contain path; path traversal risk)
    - Fix CVE-2026-120640 (POSTDATA/PUTDATA settable via query string/form field)
    - Fix CVE-2026-120642 (taint mode bypass for upload filename and other values)
    - Fix CVE-2026-120637 (unrecognised REQUEST_METHOD made argv the request params)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a04615c725 advisory.

    5.02 bump
    - Fix CVE-2026-120631 (CGI::Cookie->parse backtracking DoS via cookie expires regex)
    - Fix CVE-2026-120632 (cubic regex backtracking via crafted multipart/related Content-Type)
    - Fix CVE-2026-120650 (missing/unenforced request size, param and upload limits)
    - Fix CVE-2026-120651 (infinite loop reading short PUT/POST/PATCH body with DISABLE_UPLOADS)
    - Fix CVE-2026-120645 (scrolling_list used submitted values as regex for optgroups)
    - Fix CVE-2026-120646 (uploadInfo() dereferenced plain strings as symbolic references)
    - Fix CVE-2026-120639 (header injection via HTML entity decoding in header() extra values)
    - Fix CVE-2026-120644 (CGI::Cookie path/domain/expires not checked; ; injected attributes)
    - Fix CVE-2026-120647 (header() -attachment filename did not escape quotes)
    - Fix CVE-2026-120633 (url()/virtual_host() trusted client-supplied X-Forwarded-Host)
    - Fix CVE-2026-120638 (redirect() HTML-decoded URL after app checked it)
    - Fix CVE-2026-120636 (REQUEST_URI could produce protocol-relative or javascript: URLs)
    - Fix CVE-2026-120643 (url()/self_url() could contain raw single quote via URI->canonical)
    - Fix CVE-2026-120648 (comment() text could end HTML comment)
    - Fix CVE-2026-120634 (CGI::Carp warnings leaked between requests in persistent envs)
    - Fix CVE-2026-120635 (multipart parsing differentials; boundary smuggling)
    - Fix CVE-2026-120641 (upload filenames could contain path; path traversal risk)
    - Fix CVE-2026-120640 (POSTDATA/PUTDATA settable via query string/form field)
    - Fix CVE-2026-120642 (taint mode bypass for upload filename and other values)
    - Fix CVE-2026-120637 (unrecognised REQUEST_METHOD made argv the request params)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
375707	Linux Distros Unpatched Vulnerability : CVE-2026-120645	Nessus	Misc.	11/4/2026	11/5/2026	high
378029	Fedora 44 : perl-CGI (2026-516e427bac)	Nessus	Fedora Local Security Checks	11/10/2026	11/10/2026	critical
378037	Fedora 43 : perl-CGI (2026-a3a026d9ff)	Nessus	Fedora Local Security Checks	11/10/2026	11/10/2026	critical
378028	Fedora 45 : perl-CGI (2026-a04615c725)	Nessus	Fedora Local Security Checks	11/10/2026	11/10/2026	critical

Detections

Analytics

Plugins Search

high

critical

critical

critical