The flaw stems from CGI.pm versions before 5.00 that perform HTML entity decoding on header values after a newline check, allowing an encoded carriage return or line feed to slip through. An attacker capable of supplying data to the header, multipart_start, or do_push calls can inject arbitrary HTTP headers or split the response, enabling cache poisoning, injection of malicious content, or facilitation of click‑jacking and other downstream attacks.

Perl’s CGI.pm module, versions 4.x through 4.71. Any web application that incorporates these modules without prior input validation or sanitization remains vulnerable to header injection and response splitting.

The CVSS score is 6.5 and no EPSS data are available, indicating the exploitation probability is not quantified. The vulnerability is not reported in CISA’s KEV catalog, so no publicly known exploits exist at this time. Nonetheless, if an attacker can influence data passed into header functions, they can add arbitrary headers or split the response. This could compromise confidentiality by delivering malicious content, disrupt availability through cache poisoning, or serve as a foothold for further attacks. The likely attack vector is remote and depends on applications passing untrusted input into CGI header functions.