CVE-2026-120644
Publication date 4 November 2026
Last updated 12 November 2026
Ubuntu priority
Description
CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values. The path, domain and expires values are written into the Set-Cookie header without checking for semicolons or control characters. An application that sets them from request data can be made to add other cookie attributes, such as Domain or SameSite.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| libcgi-pm-perl | 26.10 stonking |
Needs evaluation
|
| 26.04 LTS resolute |
Needs evaluation
|
|
| 24.04 LTS noble |
Needs evaluation
|
|
| 22.04 LTS jammy |
Needs evaluation
|
|
| 20.04 LTS focal |
Needs evaluation
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial |
Needs evaluation
|
Severity score breakdown
CVSS version: CVSS v3.0
Base score
9.1 · Critical
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
References
Other references
- https://www.cve.org/CVERecord?id=CVE-2026-120644
- https://lists.security.metacpan.org/cve-announce/msg/44875022/
- https://github.com/leejo/CGI.pm/commit/0b3527faaa9de55f79ca7d59dd3bcfb2c5540e00 (v5.01)
- https://github.com/leejo/CGI.pm/commit/0b3527faaa9de55f79ca7d59dd3bcfb2c5540e00.patch
- https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI/Cookie.pm
- https://metacpan.org/release/LEEJO/CGI-5.00/changes