RHSA-2026:99849 - Security Advisory

Topic

An update for perl-CGI is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

CGI.pm is a stable, complete and mature solution for processing and preparing HTTP requests and responses. Major features including processing form submissions, file uploads, reading and writing cookies, query string generation and manipulation, and processing and preparing HTTP headers. Some HTML generation utilities are included as well. CGI.pm performs very well in in a vanilla CGI.pm environment and also comes with built-in support for mod_perl and mod_perl2 as well as FastCGI.

Security Fix(es):

• perl-cgi: perl-cgi: Denial of Service via unenforced request and upload limits (CVE-2026-120650)
• perl-cgi: perl-cgi: arbitrary file write via unsanitized upload filenames (CVE-2026-120641)
• perl-cgi: perl-cgi: Security feature bypass via untainted request parameters (CVE-2026-120642)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for ARM 64 8 aarch64
• Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 x86_64
• Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 aarch64
• Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 ppc64le
• Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 s390x

Fixes

• BZ - 2566595 - CVE-2026-120650 perl-cgi: perl-cgi: Denial of Service via unenforced request and upload limits
• BZ - 2566598 - CVE-2026-120641 perl-cgi: perl-cgi: arbitrary file write via unsanitized upload filenames
• BZ - 2566605 - CVE-2026-120642 perl-cgi: perl-cgi: Security feature bypass via untainted request parameters

CVEs

• CVE-2026-120641
• CVE-2026-120642
• CVE-2026-120650

References

• https://access.redhat.com/security/updates/classification/#important