========================================================================
CVE-2026-120634                                      CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-120634

  Distribution:  CGI
      Versions:  before 5.00
      MetaCPAN:  https://metacpan.org/dist/CGI
      VCS Repo:  https://github.com/leejo/CGI.pm

CGI::Carp versions before 5.00 for Perl leak warnings across requests
in persistent environments via the warningsToBrowser buffer

Description
-----------
CGI::Carp versions before 5.00 for Perl leak warnings across requests
in persistent environments via the warningsToBrowser buffer.

Warnings are held in a package-level buffer until warningsToBrowser
writes them into the page as HTML comments, and the buffer is never
cleared between requests. Under mod_perl, FastCGI or PSGI, warnings
from one request are written into a later one.

Warnings that contain one user's request data can appear in the HTML
sent to another user.

Problem types
-------------
- CWE-488 Exposure of Data Element to Wrong Session

Workarounds
-----------
For deployments that cannot upgrade, do not use warningsToBrowser in
persistent environments. After upgrading, persistent applications where
nothing calls CGI::initialize_globals between requests must also call
CGI::Carp::_reset_globals at the start of each request.

Solutions
---------
Upgrade to CGI 5.00 or later.

References
----------
https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI/Carp.pm
https://metacpan.org/release/LEEJO/CGI-5.00/changes
https://github.com/leejo/CGI.pm/commit/604a83fec105f75fe06f1a75026c4c34fd5a1f61.patch