External risk intelligence

CGI::Cookie Attribute Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-120644

The vulnerability exists in a Perl library used to construct Set-Cookie headers. Because these cookies are frequently generated by public-facing web applications and APIs based on user request data, the vulnerable component is commonly positioned at the network edge where it interacts directly with external web traffic.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in a Perl library that handles web cookies, potentially allowing attackers to inject malicious attributes. The issue arises from unvalidated cookie values being written directly into the Set-Cookie header, which could enable the modification of critical cookie settings like domain or SameSite attributes. The main concern is confirming relevance and exposure within your environment.

Flaw in cookie handling could alter security settings.
Affects how web applications manage user sessions.
Confirm if our systems use this specific library.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this by sending specially crafted input to a web application that uses a vulnerable Perl library to generate cookie headers. This input, when processed without proper validation, allows the attacker to inject additional directives into the `Set-Cookie` header. This could lead to the application setting unexpected cookie attributes, potentially enabling further malicious activity.

Unauthenticated network access.
Malicious cookie attribute injection.
Compromised cookie security.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to inject malicious attributes into "Set-Cookie" headers. This is possible when an application uses user-supplied data for the path, domain, or expires values of cookies without proper validation, potentially leading to unauthorized modification of cookie behavior.

Cookie attribute injection.
Unvalidated cookie values.
Session hijacking or data exposure.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts applications using CGI::Cookie for Perl, often found in public-facing web applications and APIs. Application owners and platform teams are likely responsible for identifying where this library is deployed and assessing its reachability and criticality. The first practical step is to locate all instances of the affected library, confirm business impact and exposure, and then coordinate remediation efforts with relevant teams, potentially including vendor coordination if the library is part of a third-party solution.

Identify affected applications and owners.
Verify external reachability and business impact.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is CGI::Cookie and how is it used?

CGI::Cookie is a Perl module specifically designed to help developers create and manage HTTP cookies. It acts as a helper library within the Perl ecosystem, simplifying the process of formatting the data sent to a web browser's cookie storage. Developers frequently include it in web applications and APIs to manage user session state, track preferences, or handle authentication tokens by generating the necessary Set-Cookie headers for browser responses.

How does CVE-2026-120644 represent a security weakness?

This CVE is a form of improper encoding or escaping, technically classified as CWE-116. The vulnerability occurs because the library fails to sanitize input values—such as the path, domain, or expiration date—before inserting them into the Set-Cookie header. By failing to filter out special characters like semicolons, the library allows an attacker to 'break out' of the intended cookie definition and inject their own security-altering attributes into the header.

When does this vulnerability trigger?

The issue is triggered only when an application takes data directly from an incoming user request and passes it into the cookie-setting functions without performing its own validation. If an application uses static, hardcoded values or fully trusted server-side data to define cookie attributes, it is not susceptible to this specific injection attack, as there is no user-controlled input for an attacker to manipulate.

Do I need to worry about this if my app is internal?

Halo Surface Signal indicates that while the vulnerability is often found in public-facing web applications at the network edge, you should still evaluate your environment. If your internal applications are reachable by a broad range of users or handle sensitive authentication data, they could still be targets. The core risk is any application using this library that processes request data to set cookies, regardless of whether it sits at the edge or deeper in your network.

What is the first step to address this issue?

Your priority is to perform an inventory of your software stack to pinpoint where the CGI::Cookie library is active. Once you have identified the applications using versions prior to 5.00, assess how they use the library to handle incoming requests. Focus your review on code paths that dynamically generate cookie headers from user input, then coordinate with your development teams to update the library and implement strict input validation for all cookie-related data.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.