CVE-2026-120637
Description
A flaw was found in perl-cgi. When processing an unrecognized HTTP request method, such as OPTIONS, the module unintentionally falls back into its default offline debugging mode. A remote attacker can exploit this issue by submitting a request with an unhandled method to force the application to populate request parameters and path information from process command-line arguments, potentially resulting in parameter injection or unexpected application behavior.
Statement
This vulnerability is rated as Moderate severity because, although an unauthenticated remote attacker can trigger the fallback mechanism using non-standard request methods, exploitation only leads to unintended parsing of process arguments rather than direct arbitrary code execution. Under standard Red Hat Enterprise Linux deployments, web servers execute CGI scripts with few or predictable command-line arguments, limiting the scope for meaningful parameter tampering. The risk is therefore restricted to potential logic discrepancies or information exposure in scripts that handle process arguments alongside web inputs, without granting unauthorized privilege escalation.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | Low | N/A | N/A |
| Integrity Impact | Low | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Access Control,Other
Technical Impact: Bypass Protection Mechanism; Read Application Data; Gain Privileges or Assume Identity; Varies by Context
Active debug code can create unintended entry points or expose sensitive information. The severity of the exposed debug code will depend on the particular instance. At the least, it will give an attacker sensitive information about the settings and mechanics of web applications on the server. At worst, as is often the case, the debug code will allow an attacker complete control over the web application and server, as well as confidential information that is accessed by either of these.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
