HTTP Header Injection in CGI for Perl Affects Multiple Versions

CVE-2026-120639

What is CVE-2026-120639?

The CGI module for Perl prior to version 5.00 is susceptible to an HTTP header injection vulnerability, which occurs due to inadequate validation of header values. This allows attackers to inject headers or split responses by manipulating the input data passed into HTTP headers, especially when the autoEscape feature is disabled. The lack of newline checks in the multipart_start and do_push functions further exacerbates the risk, permitting encoded CR or LF characters to bypass security measures. It is critical for developers using affected versions to apply available patches and adopt best practices to sanitize inputs.

References