{"affected":[{"defaultStatus":"unaffected","ecosystem":"cpan","packageName":"CGI","product":"","source":"CNA: CPANSec","vendor":"","versions":[{"lessThan":"5.00","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-120634","cwes":["CWE-488"],"description":"CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer.\n\nWarnings are held in a package-level buffer until warningsToBrowser writes them into the page as HTML comments, and the buffer is never cleared between requests. Under mod_perl, FastCGI or PSGI, warnings from one request are written into a later one.\n\nWarnings that contain one user's request data can appear in the HTML sent to another user.","epss":null,"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793749208097,"publishedAt":1793749208097,"references":[{"source":"CNA: CPANSec","tags":["technical-description"],"url":"https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI/Carp.pm"},{"source":"CNA: CPANSec","tags":["release-notes"],"url":"https://metacpan.org/release/LEEJO/CGI-5.00/changes"},{"source":"CNA: CPANSec","tags":["patch"],"url":"https://github.com/leejo/CGI.pm/commit/604a83fec105f75fe06f1a75026c4c34fd5a1f61.patch"}],"remediation":[{"kind":"fix","source":"CNA: CPANSec","text":"Upgrade to CGI 5.00 or later."},{"kind":"workaround","source":"CNA: CPANSec","text":"For deployments that cannot upgrade, do not use warningsToBrowser in persistent environments. After upgrading, persistent applications where nothing calls CGI::initialize_globals between requests must also call CGI::Carp::_reset_globals at the start of each request."},{"kind":"fix","source":"CNA: CPANSec","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/leejo/CGI.pm/commit/604a83fec105f75fe06f1a75026c4c34fd5a1f61.patch"}],"revision":"f9edcecb1de6e03f0215d3453b613c9413d1ea4f4bd6d9c66495eb4054a49d6c","sources":[{"modifiedAt":1793749208097,"name":"CNA: CPANSec","retrievedAt":1793750971917,"url":"https://www.cve.org/CVERecord?id=CVE-2026-120634"}],"ssvc":null,"status":"published","title":"CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer","updatedAt":1793750971917}