CVE-2026-120639

A flaw was found in perl-cgi, where it fails to properly validate newline characters when generating HTTP headers. When an application passes untrusted input into header fields, entity-encoded newlines or unvalidated parameters can bypass sanitization checks. A remote attacker could exploit this vulnerability to perform HTTP header injection or HTTP response splitting, potentially leading to cache poisoning, cross-site scripting (XSS), or session hijacking.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.