Bug 2566602 (CVE-2026-120635)

Summary: CVE-2026-120635 perl-CGI: perl-CGI: Security control bypass via improper multipart parsing
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in perl-CGI. Due to discrepancies in how multipart form-data requests are parsed compared to standard specifications, a remote attacker can smuggle form fields past intermediate proxies and Web Application Firewalls (WAFs). By submitting specially crafted multipart requests, an attacker can bypass security inspections to deliver uninspected input or corrupt form data processed by backend applications.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2567298    
Bug Blocks:    

Description OSIDB Bzimport 2026-11-03 23:51:58 UTC 
CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs.

The multipart/form-data parser matches the boundary anywhere rather than at the start of a line, uses the boundary without its leading -- for some client-supplied User-Agent values, finds the Content-Disposition name and filename inside the quoted values of other parameters, and corrupts parts when the boundary nears the 4096-byte read size.