The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a3a026d9ff advisory.

    5.02 bump
    - Fix CVE-2026-120631 (CGI::Cookie->parse backtracking DoS via cookie expires regex)
    - Fix CVE-2026-120632 (cubic regex backtracking via crafted multipart/related Content-Type)
    - Fix CVE-2026-120650 (missing/unenforced request size, param and upload limits)
    - Fix CVE-2026-120651 (infinite loop reading short PUT/POST/PATCH body with DISABLE_UPLOADS)
    - Fix CVE-2026-120645 (scrolling_list used submitted values as regex for optgroups)
    - Fix CVE-2026-120646 (uploadInfo() dereferenced plain strings as symbolic references)
    - Fix CVE-2026-120639 (header injection via HTML entity decoding in header() extra values)
    - Fix CVE-2026-120644 (CGI::Cookie path/domain/expires not checked; ; injected attributes)
    - Fix CVE-2026-120647 (header() -attachment filename did not escape quotes)
    - Fix CVE-2026-120633 (url()/virtual_host() trusted client-supplied X-Forwarded-Host)
    - Fix CVE-2026-120638 (redirect() HTML-decoded URL after app checked it)
    - Fix CVE-2026-120636 (REQUEST_URI could produce protocol-relative or javascript: URLs)
    - Fix CVE-2026-120643 (url()/self_url() could contain raw single quote via URI->canonical)
    - Fix CVE-2026-120648 (comment() text could end HTML comment)
    - Fix CVE-2026-120634 (CGI::Carp warnings leaked between requests in persistent envs)
    - Fix CVE-2026-120635 (multipart parsing differentials; boundary smuggling)
    - Fix CVE-2026-120641 (upload filenames could contain path; path traversal risk)
    - Fix CVE-2026-120640 (POSTDATA/PUTDATA settable via query string/form field)
    - Fix CVE-2026-120642 (taint mode bypass for upload filename and other values)
    - Fix CVE-2026-120637 (unrecognised REQUEST_METHOD made argv the request params)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-516e427bac advisory.

    5.02 bump
    - Fix CVE-2026-120631 (CGI::Cookie->parse backtracking DoS via cookie expires regex)
    - Fix CVE-2026-120632 (cubic regex backtracking via crafted multipart/related Content-Type)
    - Fix CVE-2026-120650 (missing/unenforced request size, param and upload limits)
    - Fix CVE-2026-120651 (infinite loop reading short PUT/POST/PATCH body with DISABLE_UPLOADS)
    - Fix CVE-2026-120645 (scrolling_list used submitted values as regex for optgroups)
    - Fix CVE-2026-120646 (uploadInfo() dereferenced plain strings as symbolic references)
    - Fix CVE-2026-120639 (header injection via HTML entity decoding in header() extra values)
    - Fix CVE-2026-120644 (CGI::Cookie path/domain/expires not checked; ; injected attributes)
    - Fix CVE-2026-120647 (header() -attachment filename did not escape quotes)
    - Fix CVE-2026-120633 (url()/virtual_host() trusted client-supplied X-Forwarded-Host)
    - Fix CVE-2026-120638 (redirect() HTML-decoded URL after app checked it)
    - Fix CVE-2026-120636 (REQUEST_URI could produce protocol-relative or javascript: URLs)
    - Fix CVE-2026-120643 (url()/self_url() could contain raw single quote via URI->canonical)
    - Fix CVE-2026-120648 (comment() text could end HTML comment)
    - Fix CVE-2026-120634 (CGI::Carp warnings leaked between requests in persistent envs)
    - Fix CVE-2026-120635 (multipart parsing differentials; boundary smuggling)
    - Fix CVE-2026-120641 (upload filenames could contain path; path traversal risk)
    - Fix CVE-2026-120640 (POSTDATA/PUTDATA settable via query string/form field)
    - Fix CVE-2026-120642 (taint mode bypass for upload filename and other values)
    - Fix CVE-2026-120637 (unrecognised REQUEST_METHOD made argv the request params)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, self_url, virtual_host     and virtual_port. These take the host name and port from the X-Forwarded-Host request header when present,     and otherwise from Host, without validating either. The URLs from url and self_url are the default     redirect location and the start_html(-base=>1) base href, and the default start_form action when     REQUEST_URI is not set. A client can poison shared caches, and URLs the application stores or sends, with     redirects, links and scripts that point at a host it controls. (CVE-2026-120633)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a04615c725 advisory.

    5.02 bump
    - Fix CVE-2026-120631 (CGI::Cookie->parse backtracking DoS via cookie expires regex)
    - Fix CVE-2026-120632 (cubic regex backtracking via crafted multipart/related Content-Type)
    - Fix CVE-2026-120650 (missing/unenforced request size, param and upload limits)
    - Fix CVE-2026-120651 (infinite loop reading short PUT/POST/PATCH body with DISABLE_UPLOADS)
    - Fix CVE-2026-120645 (scrolling_list used submitted values as regex for optgroups)
    - Fix CVE-2026-120646 (uploadInfo() dereferenced plain strings as symbolic references)
    - Fix CVE-2026-120639 (header injection via HTML entity decoding in header() extra values)
    - Fix CVE-2026-120644 (CGI::Cookie path/domain/expires not checked; ; injected attributes)
    - Fix CVE-2026-120647 (header() -attachment filename did not escape quotes)
    - Fix CVE-2026-120633 (url()/virtual_host() trusted client-supplied X-Forwarded-Host)
    - Fix CVE-2026-120638 (redirect() HTML-decoded URL after app checked it)
    - Fix CVE-2026-120636 (REQUEST_URI could produce protocol-relative or javascript: URLs)
    - Fix CVE-2026-120643 (url()/self_url() could contain raw single quote via URI->canonical)
    - Fix CVE-2026-120648 (comment() text could end HTML comment)
    - Fix CVE-2026-120634 (CGI::Carp warnings leaked between requests in persistent envs)
    - Fix CVE-2026-120635 (multipart parsing differentials; boundary smuggling)
    - Fix CVE-2026-120641 (upload filenames could contain path; path traversal risk)
    - Fix CVE-2026-120640 (POSTDATA/PUTDATA settable via query string/form field)
    - Fix CVE-2026-120642 (taint mode bypass for upload filename and other values)
    - Fix CVE-2026-120637 (unrecognised REQUEST_METHOD made argv the request params)



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
378037	Fedora 43 : perl-CGI (2026-a3a026d9ff)	Nessus	Fedora Local Security Checks	2026/11/10	2026/11/10	critical
378029	Fedora 44 : perl-CGI (2026-516e427bac)	Nessus	Fedora Local Security Checks	2026/11/10	2026/11/10	critical
375691	Linux Distros Unpatched Vulnerability : CVE-2026-120633	Nessus	Misc.	2026/11/4	2026/11/5	medium
378028	Fedora 45 : perl-CGI (2026-a04615c725)	Nessus	Fedora Local Security Checks	2026/11/10	2026/11/10	critical

検出

プラグインの検索

critical

critical

medium

critical