CVE-2025-40927
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-40927
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-40927.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-40927
- Downstream
- Published
- 2025-08-29T01:15:34Z
- Modified
- 2025-08-31T11:49:03.020948Z
- Summary
- [none]
- Details
-
CGI::Simple versions before 1.282 for Perl has a HTTP response splitting flaw This vulnerability is a confirmed HTTP response splitting flaw in CGI::Simple that allows HTTP response header injection, which can be used for reflected XSS or open redirect under certain conditions.
Although some validation exists, it can be bypassed using URL-encoded values, allowing an attacker to inject untrusted content into the response via query parameters.
As a result, an attacker can inject a line break (e.g. %0A) into the parameter value, causing the server to split the HTTP response and inject arbitrary headers or even an HTML/JavaScript body, leading to reflected cross-site scripting (XSS), open redirect or other attacks.
The issue documented in CVE-2010-4410 https://www.cve.org/CVERecord?id=CVE-2010-4410 is related but the fix was incomplete.
Impact
By injecting %0A (newline) into a query string parameter, an attacker can:
- Break the current HTTP header
- Inject a new header or entire body
Deliver a script payload that is reflected in the server’s response That can lead to the following attacks:
reflected XSS
- open redirect
- cache poisoning
- header manipulation
- References
-
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2320
- https://datatracker.ietf.org/doc/html/rfc7230#section-3
- https://metacpan.org/release/MANWAR/CGI-Simple-1.281/diff/MANWAR/CGI-Simple-1.282/lib/CGI/Simple.pm
- https://metacpan.org/release/MANWAR/CGI-Simple-1.281/source/lib/CGI/Simple.pm#L1031-1035
- https://owasp.org/www-community/attacks/HTTP_Response_Splitting
- https://rt.perl.org/Public/Bug/Display.html?id=21951
- https://security-tracker.debian.org/tracker/CVE-2025-40927
Affected packages
Debian:11 / libcgi-simple-perl
Package
- Name
- libcgi-simple-perl
- Purl
- pkg:deb/debian/libcgi-simple-perl?arch=source
Debian:12 / libcgi-simple-perl
Package
- Name
- libcgi-simple-perl
- Purl
- pkg:deb/debian/libcgi-simple-perl?arch=source
Debian:13 / libcgi-simple-perl
Package
- Name
- libcgi-simple-perl
- Purl
- pkg:deb/debian/libcgi-simple-perl?arch=source
Debian:14 / libcgi-simple-perl
Package
- Name
- libcgi-simple-perl
- Purl
- pkg:deb/debian/libcgi-simple-perl?arch=source