{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/cgicookie-4.67---4.99/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-120631"},{"id":"CVE-2026-120632"},{"id":"CVE-2026-120633"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["CGI (\u003c 5.00)","CGI::Cookie (4.67 - 4.99)"],"_cs_severities":["medium"],"_cs_tags":["web-application","denial-of-service","perl","cgi"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Perl CGI module, versions prior to 5.00, contains multiple security vulnerabilities including potential denial-of-service (DoS) and host header injection. CVE-2026-120631 relates to inefficient regex parsing in CGI::Cookie (v4.67-4.99). CVE-2026-120632 involves CPU exhaustion triggered by a backtracking regex when processing XForms multipart/related Content-Type headers. CVE-2026-120633 involves improper trust of the X-Forwarded-Host header in multiple functions including url and self_url.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eApplications relying on the Perl CGI module for web request handling are vulnerable to service disruption (DoS/CPU exhaustion) and potentially manipulated request routing or link generation via host header injection.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the Perl CGI module to version 5.00 or later across all environments.\u003c/li\u003e\n\u003cli\u003eReview web application code for reliance on \u003ccode\u003eself_url\u003c/code\u003e, \u003ccode\u003eurl\u003c/code\u003e, \u003ccode\u003evirtual_host\u003c/code\u003e, or \u003ccode\u003evirtual_port\u003c/code\u003e functions to assess potential impact from X-Forwarded-Host injection.\u003c/li\u003e\n\u003cli\u003eImplement upstream WAF or load balancer rules to sanitize or strip X-Forwarded-Host headers if upgrading is delayed.\u003c/li\u003e\n\u003cli\u003eMonitor web server CPU performance for spikes corresponding to multipart requests or cookie processing.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-04T02:15:50Z","date_published":"2026-11-04T02:15:50Z","id":"https://feed.craftedsignal.io/briefs/2026-11-perl-cgi-vulnerabilities/","summary":"Multiple vulnerabilities in the Perl CGI module library, including versions prior to 5.00, facilitate denial-of-service and CPU exhaustion via regex backtracking and allow host header injection through untrusted X-Forwarded-Host headers.","title":"Perl CGI Module: Denial of service and host header injection (CVE-2026-120631, CVE-2026-120632, CVE-2026-120633)","url":"https://feed.craftedsignal.io/briefs/2026-11-perl-cgi-vulnerabilities/"}],"language":"en","title":"CraftedSignal Threat Feed - CGI::Cookie (4.67 - 4.99)","version":"https://jsonfeed.org/version/1.1"}