{"id":"AZL-112768","summary":"CVE-2026-120639 affecting package perl-CGI 4.60-1","details":"CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipart_start and do_push.\n\nWith autoEscape off, header decodes HTML entities in extra header values after its newline check, so an encoded CR or LF reaches the response. multipart_start does not check header values for newlines, and do_push does not check the type it prints in each part.\n\nAn application that passes request data into these header values can be made to add headers or split the response.","modified":"2026-11-07T14:18:05.329830899Z","published":"2026-11-04T00:17:25Z","upstream":["CVE-2026-120639"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120639"}],"affected":[{"package":{"name":"perl-CGI","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/perl-CGI"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.60-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-112768.json"}}],"schema_version":"1.9.2"}