Warnings are held in a package-level buffer until warningsToBrowser writes them into the page as HTML comments, and the buffer is never cleared between requests. Under mod_perl, FastCGI or PSGI, warnings from one request are written into a later one.
Warnings that contain one user's request data can appear in the HTML sent to another user.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
No advisories yet.
Solution
Upgrade to CGI 5.00 or later.
Workaround
For deployments that cannot upgrade, do not use warningsToBrowser in persistent environments. After upgrading, persistent applications where nothing calls CGI::initialize_globals between requests must also call CGI::Carp::_reset_globals at the start of each request.
Wed, 04 Nov 2026 00:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer. Warnings are held in a package-level buffer until warningsToBrowser writes them into the page as HTML comments, and the buffer is never cleared between requests. Under mod_perl, FastCGI or PSGI, warnings from one request are written into a later one. Warnings that contain one user's request data can appear in the HTML sent to another user. | |
| Title | CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer | |
| Weaknesses | CWE-488 | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-11-03T23:40:08.097Z
Reserved: 2026-11-02T17:40:16.533Z
Link: CVE-2026-120634
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-04T00:17:24.577
Modified: 2026-11-04T00:17:24.577
Link: CVE-2026-120634
Redhat
No data.
OpenCVE Enrichment
No data.