Description
CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values.
The path, domain and expires values are written into the Set-Cookie header without checking for semicolons or control characters.
An application that sets them from request data can be made to add other cookie attributes, such as Domain or SameSite.
The path, domain and expires values are written into the Set-Cookie header without checking for semicolons or control characters.
An application that sets them from request data can be made to add other cookie attributes, such as Domain or SameSite.
Published:
2026-11-03
Score:
n/a
EPSS:
n/a
KEV:
No
Impact:
n/a
Action:
n/a
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
No data available yet.
Remediation
Vendor Solution
Upgrade to CGI 5.00 or later.
Tracking
Sign in to view the affected projects.
Advisories
No advisories yet.
References
History
Wed, 04 Nov 2026 00:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values. The path, domain and expires values are written into the Set-Cookie header without checking for semicolons or control characters. An application that sets them from request data can be made to add other cookie attributes, such as Domain or SameSite. | |
| Title | CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values | |
| Weaknesses | CWE-116 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-11-03T23:40:51.418Z
Reserved: 2026-11-02T17:42:50.237Z
Link: CVE-2026-120644
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-04T00:17:25.897
Modified: 2026-11-04T00:17:25.897
Link: CVE-2026-120644
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
-
CWE-116
Improper Encoding or Escaping of Output