Cookie Attribute Injection in CGI for Perl by Leejo
CVE-2026-120644

Currently unrated

Key Information:

Status
Vendor
CVE Published:
3 November 2026

What is CVE-2026-120644?

The CGI::Cookie module for Perl, specifically versions prior to 5.00, is susceptible to cookie attribute injection. This vulnerability arises when the module processes the path, domain, and expires values for cookies without proper validation, allowing malicious input to be inserted into the Set-Cookie header. Attackers can exploit this weakness to add unauthorized cookie attributes, such as Domain or SameSite, which poses significant risks for web applications relying on these cookies for security and session management. It is crucial for developers to update to version 5.00 or later to mitigate this risk.

References

https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CG...
technical-description
https://metacpan.org/release/LEEJO/CGI-5.00/changes
release-notes
https://github.com/leejo/CGI.pm/commit/0b3527faaa9de55f79...
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.