{"id":"CVE-2026-120634","published":"2026-11-04T00:17:24.577","lastModified":"2026-11-04T00:17:24.577","description":"CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer.\n\nWarnings are held in a package-level buffer until warningsToBrowser writes them into the page as HTML comments, and the buffer is never cleared between requests. Under mod_perl, FastCGI or PSGI, warnings from one request are written into a later one.\n\nWarnings that contain one user's request data can appear in the HTML sent to another user.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-488"],"vendors":[],"products":[],"references":[{"url":"https://github.com/leejo/CGI.pm/commit/604a83fec105f75fe06f1a75026c4c34fd5a1f61.patch","tags":[]},{"url":"https://metacpan.org/release/LEEJO/CGI-4.72/source/lib/CGI/Carp.pm","tags":[]},{"url":"https://metacpan.org/release/LEEJO/CGI-5.00/changes","tags":[]}],"exploitRefs":[{"url":"https://github.com/leejo/CGI.pm/commit/604a83fec105f75fe06f1a75026c4c34fd5a1f61.patch","tags":[]}],"hasPoc":true,"ai":null}