Perl modules WebDyne and CGI affected by multiple CVEs
First merged summary. November 4: 20 CVEs reported in CGI and CGI::Cookie for Perl before 5.00.
Multiple CVEs disclosed in WebDyne 2.014-3.022 and CGI before 5.00 for Perl.
Five CVEs affect WebDyne versions 2.014-3.022 for Perl, including insecure session cookies lacking Secure, HttpOnly and SameSite attributes, path traversal in PSGI API route fallback, and unescaped request parameter reflection into form fields. 20 CVEs are reported in CGI and CGI::Cookie for Perl before 5.00, enabling denial of service via cookie expires regex, CPU exhaustion from backtracking regex on XForms multipart content type, and X-Forwarded-Host trust in url, self_url, virtual_host and virtual_port. Users of these modules are impacted.
- WebDyne 2.014-3.022 affected by CVE-2026-78188 (missing Secure/HttpOnly/SameSite on cookies)
- WebDyne 2.014-3.022 affected by CVE-2026-78189 (path traversal in PSGI API)
- WebDyne 2.014-3.022 affected by CVE-2026-78190 (unescaped parameter reflection)
- CGI and CGI::Cookie before 5.00 affected by 20 CVEs
- CGI::Cookie 4.67 before 5.00 affected by CVE-2026-120631 (DoS)
- CGI before 5.00 affected by CVE-2026-120632 (CPU exhaustion)
Timeline
dated events in the reporting · oldest first- Oct 31, 2026WebDyne for Perl versions 2.014-3.022 has 5 CVEs disclosed · oss-security
- Nov 4, 2026CGI and CGI::Cookie for Perl before 5.00 have 20 CVEs disclosed · oss-security
What each outlet adds
beyond the shared facts- oss-securityWebDyne CVEs for insecure cookies and PSGI path traversal
- oss-security20 CVEs in CGI and CGI::Cookie for DoS and spoofing
- Products
- CGI
Coverage
oldest first · one row per article · UTC- · 3d ago
oss-securityFirst report
WebDyne for Perl has five CVEs including cookie and path traversal issues
WebDyne versions 2.014-3.022 for Perl issue insecure session cookies and allow path traversal in PSGI API.
- · 5h ago
CGI versions before 5.00 for Perl (20 CVEs)
20 CVEs in CGI and CGI::Cookie for Perl before 5.00 allow denial of service, CPU exhaustion and header spoofing.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-120631 | DoS in Perl CGI::Cookie before 5.00 via expires regex | — | — | ||
CVE-2026-120632+1 related CVE | CPU exhaustion via backtracking regex in Perl CGI before 5.00 | — | — | ||
| CVE-2026-78188 | Missing secure flags in WebDyne Perl session cookies before 3.022 | — | — | ||
| CVE-2026-78189 | Path traversal RCE in WebDyne Perl before 3.022 | — | — | ||
| CVE-2026-78190 | XSS in WebDyne for Perl before 3.022 | — | — |