Threats tagged 'ghsa-mxvj-3jfg-j4p6'

CGI versions before 5.00 for Perl have a vulnerability that allows HTTP header injection. This occurs because the header decoding process decodes HTML entities after the newline check, allowing encoded carriage return or line feed characters to reach the response. Additionally, multipart_start and do_push functions do not properly validate header values or types, enabling attackers to inject headers or split HTTP responses when request data is passed into these header values.