CVE-2026-120644 CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values
CriticalCVSS 9.1
EPSS 0.42%
- Published
- Updated
- Exploit status
- No public exploit known
Description
CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values.
The path, domain and expires values are written into the Set-Cookie header without checking for semicolons or control characters.
An application that sets them from request data can be made to add other cookie attributes, such as Domain or SameSite.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libcgi-pm-perl(Debian:12) | All versions | No fix listed |
| debian/libcgi-pm-perl(Debian:14) | All versions | No fix listed |
| debian/libcgi-pm-perl(Debian:13) | All versions | No fix listed |
| redhat/perl-CGI(Red Hat:enterprise_linux:10) | All versions | No fix listed |
| redhat/perl-CGI(Red Hat:rhel_els:7) | All versions | No fix listed |
| redhat/perl-CGI(Red Hat:enterprise_linux:8) | All versions | No fix listed |
| redhat/perl-CGI(Red Hat:enterprise_linux:9) | All versions | No fix listed |
| cpan CGI | < 5.00 | 5.00 |
| debian/libcgi-pm-perl(Debian:12) | = 4.55-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.57-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.59-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.60-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.61-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.62-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.63-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.64-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.65-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.66-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.67-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.68-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.70-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.71-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 4.72-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:12) | = 5.02-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:13) | = 4.68-1 | No fix listed |
Show 14 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libcgi-pm-perl(Debian:13) | = 4.70-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:13) | = 4.71-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:13) | = 4.72-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:13) | = 5.02-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:14) | = 4.68-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:14) | = 4.70-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:14) | = 4.71-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:14) | = 4.72-1 | No fix listed |
| debian/libcgi-pm-perl(Debian:14) | = 5.02-1 | No fix listed |
| ubuntu/libcgi-pm-perl(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/libcgi-pm-perl(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/libcgi-pm-perl(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/libcgi-pm-perl(Ubuntu:26.10) | All versions | No fix listed |
| azure linux perl-CGI(Azure Linux:3.0) | All versions | No fix listed |
References
- MSRC Security Update Guide vendor-advisory
- Release Notes vendor-advisory
- Debian Security Tracker CVE-2026-120644 vendor-advisory
- Red Hat CVE page vendor-advisory
- Red Hat Bugzilla 2566604 issue-tracking
- www.cve.org
- nvd.nist.gov
- github.com patch
- metacpan.org technical-description
- metacpan.org release-notes
- Ubuntu CVE tracker vendor-advisory