CVE-2026-120637 CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHOD
CriticalCVSS 9.8
EPSS 0.53%
- Published
- Updated
- Exploit status
- No public exploit known
Description
CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHOD.
For a REQUEST_METHOD such as OPTIONS, CGI falls through to its offline debugging mode, which is on by default, and builds the parameters and path_info from the process's command line arguments.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat/perl-CGI(Red Hat:enterprise_linux:10) | All versions | No fix listed |
| redhat/perl-CGI(Red Hat:rhel_els:7) | All versions | No fix listed |
| redhat/perl-CGI(Red Hat:enterprise_linux:8) | All versions | No fix listed |
| redhat/perl-CGI(Red Hat:enterprise_linux:9) | All versions | No fix listed |
| cpan CGI | < 5.00 | 5.00 |
| debian/libcgi-pm-perl(Debian:12) | All versions | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.55-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.57-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.59-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.60-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.61-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.62-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.63-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.64-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.65-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.66-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.67-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.68-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.70-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.71-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.72-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 5.02-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:13) | All versions | No fix listed |
| debian/libcgi-pm-perl(Debian:13) | = 4.68-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:13) | = 4.70-1 | No fix listed |
Show 13 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libcgi-pm-perl(Debian:13) | = 4.71-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:13) | = 4.72-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:13) | = 5.02-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:14) | All versions | No fix listed |
| debian/libcgi-pm-perl(Debian:14) | = 4.68-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:14) | = 4.70-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:14) | = 4.71-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:14) | = 4.72-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:14) | = 5.02-1 | No fix listed |
| ubuntu/libcgi-pm-perl(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/libcgi-pm-perl(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/libcgi-pm-perl(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/libcgi-pm-perl(Ubuntu:26.10) | All versions | No fix listed |
References
- Red Hat CVE page vendor-advisory
- Red Hat Bugzilla 2566601 issue-tracking
- www.cve.org
- nvd.nist.gov
- github.com patch
- metacpan.org technical-description
- metacpan.org release-notes
- Debian Security Tracker CVE-2026-120637 vendor-advisory
- Ubuntu CVE tracker vendor-advisory