CVE-2026-120637

A flaw was found in perl-cgi. When processing an unrecognized HTTP request method, such as OPTIONS, the module unintentionally falls back into its default offline debugging mode. A remote attacker can exploit this issue by submitting a request with an unhandled method to force the application to populate request parameters and path information from process command-line arguments, potentially resulting in parameter injection or unexpected application behavior.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.