Skip to content
Fencer Vulns
no cvss —

CVE-2026-120639 json

CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipart_start and do_push

published 2026-11-03 5 d ago modified 2026-11-04 4 d ago also EUVD-2026-116606

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 13%
public exploits
0
none known

Summary

CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipart_start and do_push.

With autoEscape off, header decodes HTML entities in extra header values after its newline check, so an encoded CR or LF reaches the response. multipart_start does not check header values for newlines, and do_push does not check the type it prints in each part.

An application that passes request data into these header values can be made to add headers or split the response.

Patch / fix

  • perl-CGI openSUSE Tumbleweed 5.20.0-1.1

opensuse advisories openSUSE-SU-2026:12465-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-120639 updated cvss 6.5

perl-cgi: perl-cgi: HTTP header injection via improper newline validation

  • Red Hat Enterprise Linux 7 perl-CGI 4.61-5.el10 Red Hat Enterprise Linux 8 perl-CGI 4.61-5.el10 Red Hat Enterprise Linux 9 perl-CGI 4.61-5.el10 Red Hat Enterprise Linux 10 perl-CGI 4.61-5.el10
    affected: no fix available “Fix deferred”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.23% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-08).

Classification

Weakness
  • CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.