CGI versions before 5.00 for Perl (20 CVEs)
20 CVEs in CGI and CGI::Cookie for Perl before 5.00 allow denial of service, CPU exhaustion and header spoofing.
45
CVE-2026-120633
X-Forwarded-Host trust in CGI Perl before 5.00
- CVSS
- —
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CGI versions before 5.00 for Perl trust the X-Forwarded-Host header from the client in url, self_url, virtual_host, and virtual_port without validating the source. A malicious client triggers this by including the header in requests. The attacker can poison shared caches and inject redirects, links, and scripts pointing to a host they control. Affected are applications using CGI before 5.00.
What to do: Upgrade to CGI 5.00 or later. No workaround available.
| Product | Affected | Fixed in |
|---|---|---|
| Perl CGI | before 5.00 | 5.00 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, self_url, virtual_host and virtual_port. These take the host name and port from the X-Forwarded-Host request header when present, and otherwise from Host, without validating either. The URLs from url and self_url are the default redirect location and the start_html(-base=>1) base href, and the default start_form action when REQUEST_URI is not set. A client can poison shared caches, and URLs the application stores or sends, with redirects, links and scripts that point at a host it controls.
- Weakness
- CWE-348, CWE-601