CVE-2026-120634
UnratedPublished 2026-11-04 ยท last changed 2026-11-04
The fix
We hold no Microsoft remediation data for CVE-2026-120634, which normally means it is not a Windows CVE. For non-Microsoft software the fix is the vendor's own updated release, and the affected versions are listed below.
What it is
CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer. Warnings are held in a package-level buffer until warningsToBrowser writes them into the page as HTML comments, and the buffer is never cleared between requests. Under mod_perl, FastCGI or PSGI, warnings from one request are written into a later one. Warnings that contain one user's request data can appear in the HTML sent to another user.