{"affected":[{"defaultStatus":"unaffected","ecosystem":"cpan","packageName":"CGI","product":"","source":"CNA: CPANSec","vendor":"","versions":[{"lessThan":"5.00","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-120639","cwes":["CWE-113"],"description":"CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipart_start and do_push.\n\nWith autoEscape off, header decodes HTML entities in extra header values after its newline check, so an encoded CR or LF reaches the response. multipart_start does not check header values for newlines, and do_push does not check the type it prints in each part.\n\nAn application that passes request data into these header values can be made to add headers or split the response.","epss":null,"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793749230552,"publishedAt":1793749230552,"references":[{"source":"CNA: CPANSec","tags":["technical-description"],"url":"https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm"},{"source":"CNA: CPANSec","tags":["release-notes"],"url":"https://metacpan.org/release/LEEJO/CGI-5.00/changes"},{"source":"CNA: CPANSec","tags":["patch"],"url":"https://github.com/leejo/CGI.pm/commit/69955309d371c8093d11cf12e3ddef491537ffad.patch"},{"source":"CNA: CPANSec","tags":["patch"],"url":"https://github.com/leejo/CGI.pm/commit/7733c2753f4f240012097507cda2b6e87ae46db4.patch"}],"remediation":[{"kind":"fix","source":"CNA: CPANSec","text":"Upgrade to CGI 5.00 or later."},{"kind":"fix","source":"CNA: CPANSec","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/leejo/CGI.pm/commit/69955309d371c8093d11cf12e3ddef491537ffad.patch"},{"kind":"fix","source":"CNA: CPANSec","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/leejo/CGI.pm/commit/7733c2753f4f240012097507cda2b6e87ae46db4.patch"}],"revision":"95f9594305fa31e860cfce15a7698570a67dbd30f1b19508c91e0e84085a0350","sources":[{"modifiedAt":1793749230552,"name":"CNA: CPANSec","retrievedAt":1793750977530,"url":"https://www.cve.org/CVERecord?id=CVE-2026-120639"}],"ssvc":null,"status":"published","title":"CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipart_start and do_push","updatedAt":1793750977530}