CGI::Carp versions prior to 5.00 hold extracted warning messages in a package‑level buffer that is not cleared between web requests when running in persistent environments such as mod_perl, FastCGI or PSGI. The warningsToBrowser routine subsequently writes the accumulated buffer into HTML comments. Because the buffer persists across requests, warning messages that contain a user’s request data can be returned in a later HTTP response to a different user, exposing sensitive information. This flaw is a classic example of a data leakage vulnerability (CWE‑488).

Any installation of the Perl CGI::Carp module using a release older than 5.00, particularly those deployed in persistent server environments that do not reset global state between requests (for example, mod_perl, FastCGI, or PSGI applications). The vulnerability is present in all affected versions regardless of platform, as long as warningsToBrowser is enabled.

The flaw can be exploited by sending a crafted request that triggers a warning which contains user‑sensitive content. In a shared persistent process, the next request processed by that same process will emit the buffered warning into its response, allowing an attacker to see the data of a different user. The exploit requires no special privileges beyond the ability to send HTTP requests to the application. Because the EPSS score is unavailable and the vulnerability is not currently listed in CISA’s KEV catalog, the exploitation probability cannot be quantified precisely, but the mechanism and proof of concept are clear, making the risk high for affected deployments. The CVSS score of 5.3 indicates medium severity.