CGI::Carp versions before 5.00 for Perl have a vulnerability where warnings are leaked across requests in persistent environments such as mod_perl, FastCGI, or PSGI. This occurs because warnings are stored in a package-level buffer that is not cleared between requests, causing warnings from one user's request to appear in the HTML output of another user's request as HTML comments.