CVE-2026-120644

A flaw was found in perl-cgi. This vulnerability allows a remote attacker to inject arbitrary cookie attributes into HTTP (Hypertext Transfer Protocol) Set-Cookie response headers. The issue occurs because the module fails to properly validate semicolons or control characters in path, domain, and expiration values. If an application constructs cookies using untrusted user input, an attacker can manipulate attributes such as Domain or SameSite, potentially weakening cookie security policies and bypassing browser protections.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.