Information Disclosure in CGI::Carp for Perl Affects Multiple Web Environments
CVE-2026-120634
Currently unrated
What is CVE-2026-120634?
In CGI::Carp versions prior to 5.00, warnings generated during a user's session can inadvertently persist across multiple requests in persistent environments, such as mod_perl, FastCGI, or PSGI. The warnings are stored in a package-level buffer that retains data until specifically written to the response as HTML comments. This can lead to sensitive information, including user-specific data, being exposed to other users through the HTML output. This behavior creates a significant security risk, necessitating the prompt update to version 5.00 to mitigate the vulnerabilities.