{"id":"CVE-2026-120634","aliases":[],"cve":{"records":[{"id":"CVE-2026-120634","source":"CPANSec","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-02T17:40:16.533Z","published":"2026-11-03T23:40:08.097Z","modified":"2026-11-09T19:06:50.795Z"}],"publishers":[{"name":"CPANSec","role":"CNA","organizationId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","modified":"2026-11-03T23:40:08.097Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-09T19:06:50.795Z"}],"references":[{"url":"https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI/Carp.pm","tags":["technical-description"],"source":"CPANSec"},{"url":"https://metacpan.org/release/LEEJO/CGI-5.00/changes","tags":["release-notes"],"source":"CPANSec"},{"url":"https://github.com/leejo/CGI.pm/commit/604a83fec105f75fe06f1a75026c4c34fd5a1f61.patch","tags":["patch"],"source":"CPANSec"}],"weaknesses":[{"id":"CWE-488","description":"CWE-488 Exposure of Data Element to Wrong Session","source":"CPANSec"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-09T19:06:22.430750Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer","titleSource":"CPANSec","descriptionSource":"CPANSec","description":"CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer.\n\nWarnings are held in a package-level buffer until warningsToBrowser writes them into the page as HTML comments, and the buffer is never cleared between requests. Under mod_perl, FastCGI or PSGI, warnings from one request are written into a later one.\n\nWarnings that contain one user's request data can appear in the HTML sent to another user.","score":6.5,"severity":"medium","published":"2026-11-03T23:40:08.097Z","modified":"2026-11-09T19:06:50.795Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"","name":"CGI","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"5.00","versionType":"custom"}],"defaultStatus":"unaffected","packageURL":"pkg:cpan/CGI","cpes":[],"source":"CPANSec","url":"https://www.cve.org/CVERecord?id=CVE-2026-120634"}],"remediation":[{"text":"Upgrade to CGI 5.00 or later.","source":"CPANSec","url":"https://www.cve.org/CVERecord?id=CVE-2026-120634"},{"text":"For deployments that cannot upgrade, do not use warningsToBrowser in persistent environments. After upgrading, persistent applications where nothing calls CGI::initialize_globals between requests must also call CGI::Carp::_reset_globals at the start of each request.","source":"CPANSec","url":"https://www.cve.org/CVERecord?id=CVE-2026-120634"}],"references":["https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI/Carp.pm","https://metacpan.org/release/LEEJO/CGI-5.00/changes","https://github.com/leejo/CGI.pm/commit/604a83fec105f75fe06f1a75026c4c34fd5a1f61.patch"],"sources":[{"name":"CVE","id":"CVE-2026-120634","modified":"2026-11-09T19:06:50.795Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-120634"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5}],"sourceAffected":[],"observedAt":"2026-11-09T19:34:58.278Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T03:00:33.317Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-04T10:25:34.463Z","attemptedAt":"2026-11-04T10:25:34.463Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-04T10:25:34.676Z","attemptedAt":"2026-11-04T10:25:34.676Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-04T10:25:35.248Z","attemptedAt":"2026-11-04T10:25:35.248Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-04T10:25:34.677Z","attemptedAt":"2026-11-04T10:25:34.677Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-120634","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120634","modified":"2026-11-04T00:17:24.577","checkedAt":"2026-11-04T10:25:34.463Z"},{"source":"GitHub Advisory Database","id":"GHSA-qqq9-5j87-rw35","url":"https://github.com/advisories/GHSA-qqq9-5j87-rw35","modified":"2026-11-04T00:32:29Z","checkedAt":"2026-11-04T10:25:34.676Z"},{"source":"ENISA EUVD","id":"EUVD-2026-116601","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-116601","modified":"Nov 3, 2026, 11:40:08 PM","checkedAt":"2026-11-04T10:25:35.248Z"}],"aiSummary":{"text":"CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments, potentially exposing one user's request data to another. The warningsToBrowser buffer is not cleared between requests. This weakness can lead to exposure of data elements to wrong sessions.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-04T01:06:07.569Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-120634"}]}}