CGI::Simple versions 1.281 and earlier for Perl has a HTTP response splitting flaw
Summary
| CVE | CVE-2025-40927 |
|---|---|
| State | PUBLISHED |
| Assigner | CPANSec |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2025-08-29 01:15:34 UTC |
| Updated | 2026-06-17 09:22:18 UTC |
| Description | CGI::Simple versions before 1.282 for Perl has a HTTP response splitting flaw This vulnerability is a confirmed HTTP response splitting flaw in CGI::Simple that allows HTTP response header injection, which can be used for reflected XSS or open redirect under certain conditions. Although some validation exists, it can be bypassed using URL-encoded values, allowing an attacker to inject untrusted content into the response via query parameters. As a result, an attacker can inject a line break (e.g. %0A) into the parameter value, causing the server to split the HTTP response and inject arbitrary headers or even an HTML/JavaScript body, leading to reflected cross-site scripting (XSS), open redirect or other attacks. The issue documented in CVE-2010-4410 https://www.cve.org/CVERecord?id=CVE-2010-4410 is related but the fix was incomplete. Impact By injecting %0A (newline) into a query string parameter, an attacker can: * Break the current HTTP header * Inject a new header or entire body * Deliver a script payload that is reflected in the server’s response That can lead to the following attacks: * reflected XSS * open redirect * cache poisoning * header manipulation |
Risk And Classification
Primary CVSS: v3.1 7.3 HIGH from ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS: 0.004660000 probability, percentile 0.389010000 (date 2026-10-18)
Problem Types: CWE-113 | CWE-113 CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | ADP | DECLARED | 7.3 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
| 3.1 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary | 7.3 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
LowIntegrity
LowAvailability
LowCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| metacpan.org/release/MANWAR/CGI-Simple-1.281/diff/MANWAR/CGI-Simple-1.282/... | 9b29abf9-4ab0-4765-b253-1875cd9b441e | metacpan.org | |
| metacpan.org/release/MANWAR/CGI-Simple-1.281/source/lib/CGI/Simple.pm | 9b29abf9-4ab0-4765-b253-1875cd9b441e | metacpan.org | |
| cve.mitre.org/cgi-bin/cvename.cgi | 9b29abf9-4ab0-4765-b253-1875cd9b441e | cve.mitre.org | |
| owasp.org/www-community/attacks/HTTP_Response_Splitting | 9b29abf9-4ab0-4765-b253-1875cd9b441e | owasp.org | |
| datatracker.ietf.org/doc/html/rfc7230 | 9b29abf9-4ab0-4765-b253-1875cd9b441e | datatracker.ietf.org | |
| rt.perl.org/Public/Bug/Display.html | 9b29abf9-4ab0-4765-b253-1875cd9b441e | rt.perl.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Maxim Kosenko (en)
Additional Advisory Data
Solutions
CNA: Upgrade CGI::Simple to version 1.282 or higher
There are currently no legacy QID mappings associated with this CVE.