Is CVE-2026-120639 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-120639 being exploited in the wild.

How severe is CVE-2026-120639?

Informational severity, published 4 November 2026.

How is CVE-2026-120639 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-120639?

Check whether you run Perl CGI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-120639: CGI HTTP header injection via entity decoding in header values

CVE-2026-120639 · Severity: info · Published 2026-11-04

The Perl CGI module before version 5.00 allows attackers to inject HTTP headers or split HTTP responses by encoding newlines as HTML entities. An application that passes untrusted request data into HTTP header values can be exploited to add arbitrary headers or manipulate the response structure, potentially leading to cache poisoning or response splitting attacks.

Technologies: Perl CGI. Vendors: Perl.

Quick answers

Is CVE-2026-120639 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-120639 being exploited in the wild.
How severe is CVE-2026-120639?: Informational severity, published 4 November 2026.
Which products and versions are affected?: Perl CGI before 5.00.
Is there a fix for CVE-2026-120639?: Yes: fixed in CGI 5.00. Until then: Factor newline checking to occur after HTML entity unescaping in the header() function, and apply the same check in multipart_start() and do_push(). A centralized _check_header_values() function enforces RFC 822 compliance and rejects any CR/LF that is not part of a valid line-folding continuation. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-120639 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-120639?: Check whether you run Perl CGI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: CGI 5.00

Factor newline checking to occur after HTML entity unescaping in the header() function, and apply the same check in multipart_start() and do_push(). A centralized _check_header_values() function enforces RFC 822 compliance and rejects any CR/LF that is not part of a valid line-folding continuation.

Technical details

The vulnerability exists in three functions: header(), multipart_start(), and CGI::Push::do_push(). The header() function checks for literal newlines before HTML unescaping, allowing encoded CR/LF (
) to pass the check and become real newlines after unescaping. multipart_start() and do_push() perform no newline checking at all on values they print into headers. This enables header injection or response splitting when untrusted data reaches these functions.

Affected products

Perl CGI before 5.00

Timeline

2026-11-04: disclosed: CVE-2026-120639 published
2026-11-02: patched: Fix commit merged

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.