CVE-2011-2766
The FCGI (aka Fast CGI) module 0.70 through 0.73 for Perl, as used by CGI::Fast, uses environment...
The FCGI (aka Fast CGI) module 0.70 through 0.73 for Perl, as used by CGI::Fast, uses environment variable values from one request during processing of a later request, which allows remote attackers to bypass authentication via crafted HTTP headers.
Exploit likelihood
What each source reports
NVD Score used
The FCGI (aka Fast CGI) module 0.70 through 0.73 for Perl, as used by CGI::Fast, uses environment variable values from one request during processing of a later request, which allows remote attackers to bypass authentication via crafted HTTP headers.
- Record
CVE-2011-2766- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
The FCGI (aka Fast CGI) module 0.70 through 0.73 for Perl, as used by CGI::Fast, uses environment variable values from one request during processing of a later request, which allows remote attackers to bypass authentication via crafted HTTP headers.
- Record
CVE-2011-2766- Updated
- 2026-11-02
EUVDEUVD-2011-2740 No score
The FCGI (aka Fast CGI) module 0.70 through 0.73 for Perl, as used by CGI::Fast, uses environment variable values from one request during processing of a later request, which allows remote attackers to bypass authentication via crafted HTTP headers.
- Record
EUVD-2011-2740- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-57h3-ccpr-f6f8 No score
The FCGI (aka Fast CGI) module 0.70 through 0.73 for Perl, as used by CGI::Fast, uses environment...
The FCGI (aka Fast CGI) module 0.70 through 0.73 for Perl, as used by CGI::Fast, uses environment variable values from one request during processing of a later request, which allows remote attackers to bypass authentication via crafted HTTP headers.
- Record
GHSA-57h3-ccpr-f6f8- Weakness
- CWE-287
- Updated
- 2026-11-02
OSV No score
The FCGI (aka Fast CGI) module 0.70 through 0.73 for Perl, as used by CGI::Fast, uses environment variable values from one request during processing of a later request, which allows remote attackers to bypass authentication via crafted HTTP headers.
- Record
CVE-2011-2766- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-2766 No score
The FCGI (aka Fast CGI) module 0.70 through 0.73 for Perl, as used by CGI::Fast, uses environment variable values from one request during processing of a later request, which allows remote attackers to bypass authentication via crafted HTTP headers.
- Record
DEBIAN-CVE-2011-2766- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10387-1 No score
FastCGI-2.4.0-171.10 on GA media
These are all security issues fixed in the FastCGI-2.4.0-171.10 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10387-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libfcgi-perlDebian:12 |
before 0.73-2 | 0.73-2 |
libfcgi-perlDebian:13 |
before 0.73-2 | 0.73-2 |
libfcgi-perlDebian:14 |
before 0.73-2 | 0.73-2 |
libfcgi-perlDebian:6.0 |
before 0.71-1+squeeze1, plus listed versions 0.71-1 |
0.71-1+squeeze1 |
FastCGIopenSUSE:Tumbleweed |
before 2.4.0-171.10 | 2.4.0-171.10 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-2766 is a high vulnerability (CVSS 7.5) in Fast Cgi Project Cgi, published September 23, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.24%, the 94th percentile. Fixed in libfcgi-perl 0.73-2.
References
openwall.com/lists/oss-security/2011/09/08/2
bugs.debian.org/cgi-bin/bugreport.cgi?bug=607479
exchange.xforce.ibmcloud.com/vulnerabilities/69709
bugzilla.redhat.com/show_bug.cgi?id=736604
hermes.opensuse.org/messages/13155253
Show 9 moreShow less
rt.cpan.org/Public/Bug/Display.html?id=68380
securityfocus.com/bid/49549
debian.org/security/2011/dsa-2327
mandriva.com/security/advisories?name=MDVSA-2012:001
nvd.nist.gov/vuln/detail/CVE-2011-2766
github.com/advisories/GHSA-57h3-ccpr-f6f8
security-tracker.debian.org/tracker/CVE-2011-2766
suse.com/security/cve/CVE-2011-2766