Is CVE-2026-120634 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-120634 being exploited in the wild.

How severe is CVE-2026-120634?

Informational severity, published 4 November 2026.

How is CVE-2026-120634 attacked?

It is attacked from the adjacent network or with local access, in a software library.

Am I affected by CVE-2026-120634?

Check whether you run Perl CGI::Carp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-120634: Perl CGI::Carp information disclosure in persistent environments

CVE-2026-120634 · Severity: info · Published 2026-11-04

CGI::Carp is a Perl module for error reporting in web applications. In persistent environments like mod_perl, FastCGI, and PSGI, the module buffers warning messages that are never cleared between requests. An attacker or system administrator could see sensitive data from one user's request exposed in another user's response through HTML comments containing buffered warnings.

Vendors: Perl.

Quick answers

Is CVE-2026-120634 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-120634 being exploited in the wild.
How severe is CVE-2026-120634?: Informational severity, published 4 November 2026.
Which products and versions are affected?: Perl CGI::Carp before 5.00.
Is there a fix for CVE-2026-120634?: Yes: fixed in CGI::Carp 5.00. Until then: In persistent environments without CGI.pm, call CGI::Carp::_reset_globals() at the start of each request to clear buffered warnings and reset the warningsToBrowser() state between requests. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-120634 attacked?: It is attacked from the adjacent network or with local access, in a software library.
Am I affected by CVE-2026-120634?: Check whether you run Perl CGI::Carp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: CGI::Carp 5.00

In persistent environments without CGI.pm, call CGI::Carp::_reset_globals() at the start of each request to clear buffered warnings and reset the warningsToBrowser() state between requests.

Technical details

CGI::Carp's warningsToBrowser() function stores warnings in package-level global buffers that persist across requests in long-lived processes. The vulnerable code path occurs when warnings are triggered in one request, buffered without being cleared, and then emitted as HTML comments into a subsequent request. This is a cross-request information leak affecting persistent application servers (mod_perl, FastCGI, PSGI) where request isolation is not enforced at the module level.

Affected products

Perl CGI::Carp before 5.00

Timeline

2026-11-04: disclosed
2026-11-02: patched: Fix applied in commit 604a83fec105f75fe06f1a75026c4c34fd5a1f61

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.