Bug 2566604 (CVE-2026-120644)

Summary: CVE-2026-120644 perl-cgi: perl-cgi: Cookie attribute injection via unvalidated parameters
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in perl-cgi. This vulnerability allows a remote attacker to inject arbitrary cookie attributes into HTTP (Hypertext Transfer Protocol) Set-Cookie response headers. The issue occurs because the module fails to properly validate semicolons or control characters in path, domain, and expiration values. If an application constructs cookies using untrusted user input, an attacker can manipulate attributes such as Domain or SameSite, potentially weakening cookie security policies and bypassing browser protections.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2567296    
Bug Blocks:    

Description OSIDB Bzimport 2026-11-03 23:52:05 UTC 
CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values.

The path, domain and expires values are written into the Set-Cookie header without checking for semicolons or control characters.

An application that sets them from request data can be made to add other cookie attributes, such as Domain or SameSite.