https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 08 Nov 2026 23:54:08 +0000 https://db.gcve.eu/vuln/cve-2026-120639 <p><strong>Affected:</strong> CGI</p> <p>CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipart_start and do_push.</p> <p>With autoEscape off, header decodes HTML entities in extra header values after its newline check, so an encoded CR or LF reaches the response. multipart_start does not check header values for newlines, and do_push does not check the type it prints in each part.</p> <p>An application that passes request data into these header values can be made to add headers or split the response.</p> <p><strong>Affected:</strong> CGI</p> <p>CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and unchecked values in multipart_start and do_push.</p> <p>With autoEscape off, header decodes HTML entities in extra header values after its newline check, so an encoded CR or LF reaches the response. multipart_start does not check header values for newlines, and do_push does not check the type it prints in each part.</p> <p>An application that passes request data into these header values can be made to add headers or split the response.</p> https://db.gcve.eu/vuln/cve-2026-120639