← CVE catalog

CVE-2026-120644

Unrated

Published 2026-11-04 ยท last changed 2026-11-04

The fix

We hold no Microsoft remediation data for CVE-2026-120644, which normally means it is not a Windows CVE. For non-Microsoft software the fix is the vendor's own updated release, and the affected versions are listed below.

What it is

CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values. The path, domain and expires values are written into the Set-Cookie header without checking for semicolons or control characters. An application that sets them from request data can be made to add other cookie attributes, such as Domain or SameSite.

Sources