{"id":"CVE-2025-40927","state":"PUBLISHED","title":"CGI::Simple versions 1.281 and earlier for Perl has a HTTP response splitting flaw","description":"CGI::Simple versions before 1.282 for Perl has a HTTP response splitting flaw\nThis vulnerability is a confirmed HTTP response splitting flaw in CGI::Simple that allows HTTP response header injection, which can be used for reflected XSS or open redirect under certain conditions.\n\nAlthough some validation exists, it can be bypassed using URL-encoded values, allowing an attacker to inject untrusted content into the response via query parameters.\n\n\n\nAs a result, an attacker can inject a line break (e.g. %0A) into the parameter value, causing the server to split the HTTP response and inject arbitrary headers or even an HTML/JavaScript body, leading to reflected cross-site scripting (XSS), open redirect or other attacks.\n\nThe issue documented in CVE-2010-4410 https://www.cve.org/CVERecord?id=CVE-2010-4410 is related but the fix was incomplete.\n\nImpact\n\nBy injecting %0A (newline) into a query string parameter, an attacker can:\n\n  *  Break the current HTTP header\n  *  Inject a new header or entire body\n  *  Deliver a script payload that is reflected in the server’s response\nThat can lead to the following attacks:\n\n  *  reflected XSS\n  *  open redirect\n  *  cache poisoning\n  *  header manipulation","publishedAt":"2025-08-29T00:10:07.161Z","updatedAt":"2025-08-29T13:18:32.704Z","severity":{"score":7.3,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","source":"CISA-ADP"},"assigner":"CPANSec","products":["MANWAR CGI::Simple"],"affected":[{"vendor":"MANWAR","product":"CGI::Simple","packageName":"CGI-Simple","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.282","versionType":"custom"}],"collectionURL":"https://cpan.org/modules","programFiles":["lib/CGI/Simple.pm"],"repo":"https://github.com/manwar/CGI--Simple"}],"references":["https://metacpan.org/release/MANWAR/CGI-Simple-1.281/source/lib/CGI/Simple.pm#L1031-1035","https://metacpan.org/release/MANWAR/CGI-Simple-1.281/diff/MANWAR/CGI-Simple-1.282/lib/CGI/Simple.pm","https://owasp.org/www-community/attacks/HTTP_Response_Splitting","https://datatracker.ietf.org/doc/html/rfc7230#section-3","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2320","https://rt.perl.org/Public/Bug/Display.html?id=21951"],"weaknesses":["CWE-113"],"ingestedAt":"2026-10-29T20:09:09.358Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/40xxx/CVE-2025-40927.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-40927","state":"PUBLISHED","datePublished":"2025-08-29T00:10:07.161Z","dateUpdated":"2025-08-29T13:18:32.704Z","assignerShortName":"CPANSec","assignerOrgId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","dateReserved":"2025-04-16T09:05:34.362Z"},"containers":{"cna":{"title":"CGI::Simple versions 1.281 and earlier for Perl has a HTTP response splitting flaw","descriptions":[{"lang":"en","value":"CGI::Simple versions before 1.282 for Perl has a HTTP response splitting flaw\nThis vulnerability is a confirmed HTTP response splitting flaw in CGI::Simple that allows HTTP response header injection, which can be used for reflected XSS or open redirect under certain conditions.\n\nAlthough some validation exists, it can be bypassed using URL-encoded values, allowing an attacker to inject untrusted content into the response via query parameters.\n\n\n\nAs a result, an attacker can inject a line break (e.g. %0A) into the parameter value, causing the server to split the HTTP response and inject arbitrary headers or even an HTML/JavaScript body, leading to reflected cross-site scripting (XSS), open redirect or other attacks.\n\nThe issue documented in CVE-2010-4410 https://www.cve.org/CVERecord?id=CVE-2010-4410 is related but the fix was incomplete.\n\nImpact\n\nBy injecting %0A (newline) into a query string parameter, an attacker can:\n\n  *  Break the current HTTP header\n  *  Inject a new header or entire body\n  *  Deliver a script payload that is reflected in the server’s response\nThat can lead to the following attacks:\n\n  *  reflected XSS\n  *  open redirect\n  *  cache poisoning\n  *  header manipulation"}],"affected":[{"vendor":"MANWAR","product":"CGI::Simple","packageName":"CGI-Simple","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.282","versionType":"custom"}],"collectionURL":"https://cpan.org/modules","programFiles":["lib/CGI/Simple.pm"],"repo":"https://github.com/manwar/CGI--Simple"}],"references":[{"url":"https://metacpan.org/release/MANWAR/CGI-Simple-1.281/source/lib/CGI/Simple.pm#L1031-1035","tags":["related"]},{"url":"https://metacpan.org/release/MANWAR/CGI-Simple-1.281/diff/MANWAR/CGI-Simple-1.282/lib/CGI/Simple.pm","tags":["related"]},{"url":"https://owasp.org/www-community/attacks/HTTP_Response_Splitting","tags":["technical-description"]},{"url":"https://datatracker.ietf.org/doc/html/rfc7230#section-3","tags":["technical-description"]},{"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2320","tags":["related"]},{"url":"https://rt.perl.org/Public/Bug/Display.html?id=21951","tags":["related"]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-113","description":"CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CPANSec","orgId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","dateUpdated":"2025-08-29T00:10:07.161Z"},"credits":[{"lang":"en","type":"finder","value":"Maxim Kosenko"}],"impacts":[{"capecId":"CAPEC-34","descriptions":[{"lang":"en","value":"CAPEC-34 HTTP Response Splitting"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Upgrade CGI::Simple to version 1.282 or higher"}],"value":"Upgrade CGI::Simple to version 1.282 or higher"}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-08-29T13:18:01.758812Z","id":"CVE-2025-40927","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-08-29T13:18:32.704Z"}}]}}}