Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-120644 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values. The path, domain and expires values are written into the Set-Cookie header without checking for semicolons or control characters. An application that sets them from request data can be made to add other cookie attributes, such as Domain or SameSite.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:5.3 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/leejo/CGI.pm/commit/0b3527faaa9de55f79ca7d59dd3bcfb2c5540e00.patch	CPANSec	Source CodeVendor
https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI/Cookie.pm	CPANSec	Source CodeVendor
https://metacpan.org/release/LEEJO/CGI-5.00/changes	CPANSec	AdvisoryBundleVendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-116	Improper Encoding or Escaping of Output	CPANSec

Affected Products

Product	Versions
CGI::Cookie	< 5.00
CPE No CPEs found in CPE dictionary for this product. Remediation Upgrade: 5.00moderate effort

Change History

1 change record found show changes