{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-120635", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-11-02T17:40:25.384Z", "datePublished": "2026-11-03T23:40:15.070Z", "dateUpdated": "2026-11-09T19:08:06.676Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["CGI"], "packageName": "CGI", "packageURL": "pkg:cpan/CGI", "programFiles": ["lib/CGI.pm"], "programRoutines": [{"name": "CGI::read_multipart"}, {"name": "CGI::_mp_value_parse"}, {"name": "CGI::MultipartBuffer::new"}, {"name": "CGI::MultipartBuffer::read"}], "repo": "https://github.com/leejo/CGI.pm", "versions": [{"lessThan": "5.00", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs.\n\nThe multipart/form-data parser matches the boundary anywhere rather than at the start of a line, uses the boundary without its leading -- for some client-supplied User-Agent values, finds the Content-Disposition name and filename inside the quoted values of other parameters, and corrupts parts when the boundary nears the 4096-byte read size."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-436", "description": "CWE-436 Interpretation Conflict", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-11-03T23:40:15.070Z"}, "references": [{"tags": ["technical-description"], "url": "https://www.rfc-editor.org/rfc/rfc2046#section-5.1.1"}, {"tags": ["technical-description"], "url": "https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm"}, {"tags": ["release-notes"], "url": "https://metacpan.org/release/LEEJO/CGI-5.00/changes"}, {"tags": ["patch"], "url": "https://github.com/leejo/CGI.pm/commit/f719fc08e8756708bcd4f1e357d5c0f8702f85dd.patch"}, {"tags": ["patch"], "url": "https://github.com/leejo/CGI.pm/commit/cbf04979f9974458ac223793bbd9d0b6a772aa66.patch"}, {"tags": ["patch"], "url": "https://github.com/leejo/CGI.pm/commit/fe9516804d59a3774e280c15dbb7072fbd0ba5f1.patch"}, {"tags": ["patch"], "url": "https://github.com/leejo/CGI.pm/commit/e0ef8f4248c6ae3025749040d8595d206b6a1b49.patch"}], "solutions": [{"lang": "en", "value": "Upgrade to CGI 5.00 or later."}], "source": {"discovery": "UNKNOWN"}, "title": "CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T19:07:24.249552Z", "id": "CVE-2026-120635", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T19:08:06.676Z"}}]}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "modules": ["CGI"], "packageName": "CGI", "packageURL": "pkg:cpan/CGI", "programFiles": ["lib/CGI.pm"], "programRoutines": [{"name": "CGI::read_multipart"}, {"name": "CGI::_mp_value_parse"}, {"name": "CGI::MultipartBuffer::new"}, {"name": "CGI::MultipartBuffer::read"}], "repo": "https://github.com/leejo/CGI.pm", "versions": [{"lessThan": "5.00", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs.\n\nThe multipart/form-data parser matches the boundary anywhere rather than at the start of a line, uses the boundary without its leading -- for some client-supplied User-Agent values, finds the Content-Disposition name and filename inside the quoted values of other parameters, and corrupts parts when the boundary nears the 4096-byte read size."}], "id": "CVE-2026-120635", "lastModified": "2026-11-09T19:16:43.960", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-120635", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T19:07:24.249552Z", "version": "2.0.3"}}]}, "published": "2026-11-04T00:17:24.730", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/leejo/CGI.pm/commit/cbf04979f9974458ac223793bbd9d0b6a772aa66.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/leejo/CGI.pm/commit/e0ef8f4248c6ae3025749040d8595d206b6a1b49.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/leejo/CGI.pm/commit/f719fc08e8756708bcd4f1e357d5c0f8702f85dd.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/leejo/CGI.pm/commit/fe9516804d59a3774e280c15dbb7072fbd0ba5f1.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/LEEJO/CGI-5.00/changes"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://www.rfc-editor.org/rfc/rfc2046#section-5.1.1"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-436"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{"bugzilla": {"description": "perl-CGI: perl-CGI: Security control bypass via improper multipart parsing", "id": "2566602", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2566602"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-444", "details": ["A flaw was found in perl-CGI. Due to discrepancies in how multipart form-data requests are parsed compared to standard specifications, a remote attacker can smuggle form fields past intermediate proxies and Web Application Firewalls (WAFs). By submitting specially crafted multipart requests, an attacker can bypass security inspections to deliver uninspected input or corrupt form data processed by backend applications."], "name": "CVE-2026-120635", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "perl-CGI", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "perl-CGI", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "perl-CGI", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "perl-CGI", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-11-03T23:40:15Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-120635\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-120635\nhttps://github.com/leejo/CGI.pm/commit/cbf04979f9974458ac223793bbd9d0b6a772aa66.patch\nhttps://github.com/leejo/CGI.pm/commit/e0ef8f4248c6ae3025749040d8595d206b6a1b49.patch\nhttps://github.com/leejo/CGI.pm/commit/f719fc08e8756708bcd4f1e357d5c0f8702f85dd.patch\nhttps://github.com/leejo/CGI.pm/commit/fe9516804d59a3774e280c15dbb7072fbd0ba5f1.patch\nhttps://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI.pm\nhttps://metacpan.org/release/LEEJO/CGI-5.00/changes\nhttps://www.rfc-editor.org/rfc/rfc2046#section-5.1.1"], "threat_severity": "Moderate"}

{"created": "2026-11-04T11:00:15.371349+00:00", "updated": "2026-11-09T20:30:16.226930+00:00", "vendors": []}