CVE-2026-120644
Description
A flaw was found in perl-cgi. This vulnerability allows a remote attacker to inject arbitrary cookie attributes into HTTP (Hypertext Transfer Protocol) Set-Cookie response headers. The issue occurs because the module fails to properly validate semicolons or control characters in path, domain, and expiration values. If an application constructs cookies using untrusted user input, an attacker can manipulate attributes such as Domain or SameSite, potentially weakening cookie security policies and bypassing browser protections.
Statement
This vulnerability is rated as Moderate impact because exploitation depends on custom web applications directly supplying unvalidated user input into cookie attributes, rather than exposing systems by default. In Red Hat Enterprise Linux environments, perl-CGI functions as a library rather than an autonomous network service, meaning standard installations remain unexposed unless targeted scripts explicitly process untrusted request data. Furthermore, successful abuse is confined to manipulating client-side cookie properties such as domain boundaries and policy flags, without providing a mechanism for arbitrary code execution or server compromise.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.3 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | Required | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | Low | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Understanding the Weakness (CWE)
Integrity
Technical Impact: Unexpected State
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
