CVE-2026-120639 Details

A vulnerability exists in CGI versions prior to 5.00 for Perl, allowing HTTP header injection through entity decoding that occurs after a newline check in header values. This issue arises when the autoEscape feature is turned off, as header values can be manipulated to include encoded carriage return or line feed characters, which are then interpreted as actual newlines in the HTTP response. Additionally, the multipart_start and do_push methods do not properly validate header values for newlines, creating further exploitation opportunities. Applications that use these CGI features to handle request data can be tricked into injecting headers or splitting the response, potentially leading to various attacks such as cross-site scripting or cookie manipulation.

Users are advised to upgrade to CGI version 5.00 or later, where this vulnerability has been fixed. In the meantime, be cautious when handling multipart form data or using the header() function with untrusted input.