The multipart/form-data parser matches the boundary anywhere rather than at the start of a line, uses the boundary without its leading -- for some client-supplied User-Agent values, finds the Content-Disposition name and filename inside the quoted values of other parameters, and corrupts parts when the boundary nears the 4096-byte read size.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
Upgrade to CGI 5.00 or later.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 04 Nov 2026 00:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs. The multipart/form-data parser matches the boundary anywhere rather than at the start of a line, uses the boundary without its leading -- for some client-supplied User-Agent values, finds the Content-Disposition name and filename inside the quoted values of other parameters, and corrupts parts when the boundary nears the 4096-byte read size. | |
| Title | CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs | |
| Weaknesses | CWE-436 | |
| References |
|
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-11-03T23:40:15.070Z
Reserved: 2026-11-02T17:40:25.384Z
Link: CVE-2026-120635
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-04T00:17:24.730
Modified: 2026-11-04T00:17:24.730
Link: CVE-2026-120635
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-436
Interpretation Conflict