CVE-2026-120634 Details
Description
CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer. Warnings are held in a package-level buffer until warningsToBrowser writes them into the page as HTML comments, and the buffer is never cleared between requests. Under mod_perl, FastCGI or PSGI, warnings from one request are written into a later one. Warnings that contain one user's request data can appear in the HTML sent to another user.
A vulnerability in CGI::Carp prior to version 5.00 for Perl allows warnings to leak between requests in persistent environments, such as mod_perl, FastCGI, or PSGI. The 'warningsToBrowser' function buffers warnings at the package level, which are then written to the HTML response as comments. This buffer is not cleared between requests, leading to a situation where one user's warnings can be seen by another user. Additionally, warnings can be emitted before the HTTP headers of a new request are sent, causing further issues.
Users should upgrade to CGI::Carp version 5.00 or later, where this vulnerability has been fixed. Instructions for upgrading can be found in the release notes for version 5.00.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/leejo/CGI.pm/commit/604a83fec105f75fe06f1a75026c4c34fd5a1f61.patch | CPANSec | Source CodeVendor |
| https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI/Carp.pm | CPANSec | Source CodeVendor |
| https://metacpan.org/release/LEEJO/CGI-5.00/changes | CPANSec | AdvisoryBundleVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-488 | Exposure of Data Element to Wrong Session | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| CGI::Carp | < 5.00 |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | New CVE Received | CPANSec |