# CVE-2026-120637: Perl CGI parameter injection via unrecognized REQUEST_METHOD

Source: https://junglewise.ai/threats/cve-2026-120637-cgi-versions-before-5-00-for-perl-take-request-parameters-from  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-120637 · Severity: info · Published 2026-11-04

The CGI module for Perl, used by web applications to handle HTTP requests, has a debugging feature enabled by default that processes command-line arguments as request parameters when an unrecognized HTTP method (like OPTIONS or PROPFIND) is sent. An attacker can exploit this by sending requests with unusual HTTP methods, causing the web server process's own command-line arguments to be interpreted as user-supplied parameters, potentially exposing sensitive information or allowing parameter injection attacks.

Technologies: [Perl CGI](https://junglewise.ai/threats/technologies/perl-cgi). Vendors: [Perl](https://junglewise.ai/threats/vendors/perl).

## Quick answers

**Is CVE-2026-120637 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120637 being exploited in the wild.

**How severe is CVE-2026-120637?** Informational severity, published 4 November 2026.

**Which products and versions are affected?** Perl CGI before 5.00.

**Is there a fix for CVE-2026-120637?** Yes: fixed in CGI 5.00. Until then: Upgrade to CGI 5.00 or later. As an interim measure, disable the $DEBUG flag by setting $CGI::DEBUG = 0 before creating CGI objects in your application. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120637 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-120637?** Check whether you run Perl CGI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in CGI 5.00

Upgrade to CGI 5.00 or later. As an interim measure, disable the $DEBUG flag by setting $CGI::DEBUG = 0 before creating CGI objects in your application.

## Technical details

The vulnerability exists in CGI.pm versions before 5.00, where the offline debugging mode (controlled by $DEBUG, enabled by default) incorrectly activates for any unrecognized REQUEST_METHOD instead of only when there is no HTTP request at all. An attacker can send a request with a non-standard REQUEST_METHOD (e.g., OPTIONS, PROPFIND, lowercase "post") to a CGI application, causing the process command-line arguments to be parsed as CGI parameters and path_info. The fix restricts offline mode activation to cases where REQUEST_METHOD is undefined and the process is not running under any CGI server (CGI, FastCGI, or mod_perl).

## Affected products

- Perl CGI before 5.00

## Timeline

- 2026-11-04: disclosed
- 2026-11-02: patched: Fix committed to GitHub

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/leejo/CGI.pm/commit/b753ff75a3bc4554c075cc37c1db605a55297029.patch](https://github.com/leejo/CGI.pm/commit/b753ff75a3bc4554c075cc37c1db605a55297029.patch)

## Related threats

- [Perl CGI infinite loop in read_postdata_putdata with disabled uploads](https://junglewise.ai/threats/cve-2026-120651-cgi-versions-before-5-00-for-perl-allow-an-infinite-loop-on-a)
- [CGI for Perl resource exhaustion via missing upload limits](https://junglewise.ai/threats/cve-2026-120650-cgi-versions-before-5-00-for-perl-allow-memory-cpu-and-disk)
- [Perl CGI HTML injection via comment delimiter](https://junglewise.ai/threats/cve-2026-120648-cgi-versions-before-5-00-for-perl-allow-html-injection-via-text)
- [Perl CGI header attachment parameter injection](https://junglewise.ai/threats/cve-2026-120647-cgi-versions-before-5-00-for-perl-allow-content-disposition)
- [Perl CGI cross-site scripting in url and self_url](https://junglewise.ai/threats/cve-2026-120643-cgi-versions-from-4-62-before-5-00-for-perl-allow-cross-site)