Skip to content
Threat Feed
Subscribe
medium advisory

Perl CGI Module: Denial of service and host header injection (CVE-2026-120631, CVE-2026-120632, CVE-2026-120633)

Multiple vulnerabilities in the Perl CGI module library, including versions prior to 5.00, facilitate denial-of-service and CPU exhaustion via regex backtracking and allow host header injection through untrusted X-Forwarded-Host headers.

CVE search metadata

CVE search record: CVE-2026-120631. KEV: no. Product: CGI (< 5.00), CGI::Cookie (4.67 - 4.99). Brief: Perl CGI Module: Denial of service and host header injection (CVE-2026-120631, CVE-2026-120632, CVE-2026-120633). Brief link: https://feed.craftedsignal.io/briefs/2026-11-perl-cgi-vulnerabilities/

CVE search record: CVE-2026-120632. KEV: no. Product: CGI (< 5.00), CGI::Cookie (4.67 - 4.99). Brief: Perl CGI Module: Denial of service and host header injection (CVE-2026-120631, CVE-2026-120632, CVE-2026-120633). Brief link: https://feed.craftedsignal.io/briefs/2026-11-perl-cgi-vulnerabilities/

CVE search record: CVE-2026-120633. KEV: no. Product: CGI (< 5.00), CGI::Cookie (4.67 - 4.99). Brief: Perl CGI Module: Denial of service and host header injection (CVE-2026-120631, CVE-2026-120632, CVE-2026-120633). Brief link: https://feed.craftedsignal.io/briefs/2026-11-perl-cgi-vulnerabilities/

Triage facts

Revision 1
Applicability
CGI (< 5.00), CGI::Cookie (4.67 - 4.99)
Evidence
Unknown
Severity
Medium
Action
Elevated
Sources
1 public source
Freshness
Revision 1Nov 4, 02:15 UTC
Vulnerabilities
3 CVEs
Source quality
B2Likely

The Perl CGI module, versions prior to 5.00, contains multiple security vulnerabilities including potential denial-of-service (DoS) and host header injection. CVE-2026-120631 relates to inefficient regex parsing in CGI::Cookie (v4.67-4.99). CVE-2026-120632 involves CPU exhaustion triggered by a backtracking regex when processing XForms multipart/related Content-Type headers. CVE-2026-120633 involves improper trust of the X-Forwarded-Host header in multiple functions including url and self_url.

Impact

Applications relying on the Perl CGI module for web request handling are vulnerable to service disruption (DoS/CPU exhaustion) and potentially manipulated request routing or link generation via host header injection.

Recommendation

  • Upgrade the Perl CGI module to version 5.00 or later across all environments.
  • Review web application code for reliance on self_url, url, virtual_host, or virtual_port functions to assess potential impact from X-Forwarded-Host injection.
  • Implement upstream WAF or load balancer rules to sanitize or strip X-Forwarded-Host headers if upgrading is delayed.
  • Monitor web server CPU performance for spikes corresponding to multipart requests or cookie processing.

Immediate actions

Upgrade Perl CGI module to 5.00 or later

IT Operations 48h

Threat Hunt

Identify applications using Perl CGI module versions < 5.00

T1190 high high confidence hunt now

Data: Software inventory or package manifest logs

Mitigations

Sanitize X-Forwarded-Host header at WAF/Load Balancer

immediate IT Operations

CVE-2026-120633