CVE-2026-120634

MediumCVSS 6.5/10Last modified Nov 9, 2026

Description

CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer.

Warnings are held in a package-level buffer until warningsToBrowser writes them into the page as HTML comments, and the buffer is never cleared between requests. Under mod_perl, FastCGI or PSGI, warnings from one request are written into a later one.

Warnings that contain one user's request data can appear in the HTML sent to another user.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-488

Affected software

VendorProductVersions
——< 5.00

References

Timeline

Published
Nov 4, 2026
Last modified
Nov 9, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1206358.1CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs. CVE-2026-1206366.1CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_form. url(-absCVE-2026-1206379.8CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHOD. For aCVE-2026-1206386.1CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation in redirect. redireCVE-2026-1206397.2CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in CVE-2026-120647.5When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer anCVE-2026-1206406.5CGI versions before 5.00 for Perl allow the POSTDATA, PUTDATA, PATCHDATA and XForms:Model parameters to be set from the query string or formCVE-2026-1206418.8CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows paths. The name returnedCVE-2026-1206429.1CGI versions before 5.00 for Perl return request-derived values untainted under taint mode. The upload filename, uploadInfo values, some paCVE-2026-1206436.1CGI versions from 4.62 before 5.00 for Perl allow cross-site scripting via a raw apostrophe in URLs returned by url and self_url. Both passCVE-2026-1206449.1CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values. The path, domaiCVE-2026-1206457.5CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection in scrolling_list. Wh
CVE-2026-120634: Medium severity, CVSS 6.5 | Vulnix