{"id":"CVE-2025-40927","aliases":["DEBIAN-CVE-2025-40927","EUVD-2025-27982","GHSA-wh29-fq99-4ww5","UBUNTU-CVE-2025-40927","openSUSE-SU-2025:15625-1"],"status":"published","title":"CGI::Simple versions 1.281 and earlier for Perl has a HTTP response splitting flaw","description":"CGI::Simple versions before 1.282 for Perl has a HTTP response splitting flaw\nThis vulnerability is a confirmed HTTP response splitting flaw in CGI::Simple that allows HTTP response header injection, which can be used for reflected XSS or open redirect under certain conditions.\n\nAlthough some validation exists, it can be bypassed using URL-encoded values, allowing an attacker to inject untrusted content into the response via query parameters.\n\n\n\nAs a result, an attacker can inject a line break (e.g. %0A) into the parameter value, causing the server to split the HTTP response and inject arbitrary headers or even an HTML/JavaScript body, leading to reflected cross-site scripting (XSS), open redirect or other attacks.\n\nThe issue documented in CVE-2010-4410 https://www.cve.org/CVERecord?id=CVE-2010-4410 is related but the fix was incomplete.\n\nImpact\n\nBy injecting %0A (newline) into a query string parameter, an attacker can:\n\n  *  Break the current HTTP header\n  *  Inject a new header or entire body\n  *  Deliver a script payload that is reflected in the server’s response\nThat can lead to the following attacks:\n\n  *  reflected XSS\n  *  open redirect\n  *  cache poisoning\n  *  header manipulation","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00485,"percentile":0.42044,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-113"],"published":"2025-08-29T00:10:07Z","modified":"2026-10-28T02:30:41Z","fixes":[{"ecosystem":"Debian:12","package":"libcgi-simple-perl","fixed_in":["1.280-2+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libcgi-simple-perl","fixed_in":["1.282-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libcgi-simple-perl","fixed_in":["1.282-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"perl-CGI-Simple","fixed_in":["1.282.0-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libcgi-simple-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.280-2+deb12u1"}]}],"versions":["1.280-2"]},{"source":"osv","ecosystem":"Debian:13","package":"libcgi-simple-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.282-1~deb13u1"}]}],"versions":["1.281-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libcgi-simple-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.282-1"}]}],"versions":["1.281-1","1.282-1~deb13u1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libcgi-simple-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.115-1","1.115-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libcgi-simple-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.115-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libcgi-simple-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.115-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libcgi-simple-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.115-2","1.280-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libcgi-simple-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.280-2","1.281-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libcgi-simple-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.281-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libcgi-simple-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.281-1","1.282-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-CGI-Simple","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.282.0-1.1"}]}]}],"products":[{"vendor":"manwar","product":"cgi::simple"}],"references":[{"url":"https://metacpan.org/release/MANWAR/CGI-Simple-1.281/source/lib/CGI/Simple.pm#L1031-1035","tags":["related","web","report"]},{"url":"https://metacpan.org/release/MANWAR/CGI-Simple-1.281/diff/MANWAR/CGI-Simple-1.282/lib/CGI/Simple.pm","tags":["related","web","report"]},{"url":"https://owasp.org/www-community/attacks/HTTP_Response_Splitting","tags":["technical-description","article","report"]},{"url":"https://datatracker.ietf.org/doc/html/rfc7230#section-3","tags":["technical-description","article","report"]},{"url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2320","tags":["related","web","report"]},{"url":"https://rt.perl.org/Public/Bug/Display.html?id=21951","tags":["related","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40927","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wh29-fq99-4ww5"},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/40xxx/CVE-2025-40927.json","tags":["advisory"]},{"url":"https://github.com/manwar/CGI--Simple","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-40927","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-40927","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-40927","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/32357435/","tags":["report"]},{"url":"https://github.com/manwar/CGI--Simple/commit/0c1a2e0b8f24804d33daac686666ac944363a630","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40927","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-40927","title":"CGI::Simple versions 1.281 and earlier for Perl has a HTTP response splitting flaw","description":"CGI::Simple versions before 1.282 for Perl has a HTTP response splitting flaw\nThis vulnerability is a confirmed HTTP response splitting flaw in CGI::Simple that allows HTTP response header injection, which can be used for reflected XSS or open redirect under certain conditions.\n\nAlthough some validation exists, it can be bypassed using URL-encoded values, allowing an attacker to inject untrusted content into the response via query parameters.\n\n\n\nAs a result, an attacker can inject a line break (e.g. %0A) into the parameter value, causing the server to split the HTTP response and inject arbitrary headers or even an HTML/JavaScript body, leading to reflected cross-site scripting (XSS), open redirect or other attacks.\n\nThe issue documented in CVE-2010-4410 https://www.cve.org/CVERecord?id=CVE-2010-4410 is related but the fix was incomplete.\n\nImpact\n\nBy injecting %0A (newline) into a query string parameter, an attacker can:\n\n  *  Break the current HTTP header\n  *  Inject a new header or entire body\n  *  Deliver a script payload that is reflected in the server’s response\nThat can lead to the following attacks:\n\n  *  reflected XSS\n  *  open redirect\n  *  cache poisoning\n  *  header manipulation","status":"published","published":"2025-08-29T00:10:07.161Z","modified":"2025-08-29T13:18:32.704Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"adp"}],"cwes":["CWE-113"],"updated_at":"2026-11-02T14:32:34.434755Z"}],"euvd":[{"id":"EUVD-2025-27982","description":"CGI::Simple versions before 1.282 for Perl has a HTTP response splitting flaw\nThis vulnerability is a confirmed HTTP response splitting flaw in CGI::Simple that allows HTTP response header injection, which can be used for reflected XSS or open redirect under certain conditions.\n\nAlthough some validation exists, it can be bypassed using URL-encoded values, allowing an attacker to inject untrusted content into the response via query parameters.\n\n\n\nAs a result, an attacker can inject a line break (e.g. %0A) into the parameter value, causing the server to split the HTTP response and inject arbitrary headers or even an HTML/JavaScript body, leading to reflected cross-site scripting (XSS), open redirect or other attacks.\n\nThe issue documented in CVE-2010-4410 https://www.cve.org/CVERecord?id=CVE-2010-4410 is related but the fix was incomplete.\n\nImpact\n\nBy injecting %0A (newline) into a query string parameter, an attacker can:\n\n  *  Break the current HTTP header\n  *  Inject a new header or entire body\n  *  Deliver a script payload that is reflected in the server’s response\nThat can lead to the following attacks:\n\n  *  reflected XSS\n  *  open redirect\n  *  cache poisoning\n  *  header manipulation","status":"published","published":"2025-08-29T00:10:07Z","modified":"2025-08-29T13:18:32Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T20:31:50.093994Z"}],"ghsa":[{"id":"GHSA-wh29-fq99-4ww5","title":"CGI::Simple versions before 1.282 for Perl has a HTTP response splitting flaw\nThis vulnerability...","description":"CGI::Simple versions before 1.282 for Perl has a HTTP response splitting flaw\nThis vulnerability is a confirmed HTTP response splitting flaw in CGI::Simple that allows HTTP response header injection, which can be used for reflected XSS or open redirect under certain conditions.\n\nAlthough some validation exists, it can be bypassed using URL-encoded values, allowing an attacker to inject untrusted content into the response via query parameters.\n\n\n\nAs a result, an attacker can inject a line break (e.g. %0A) into the parameter value, causing the server to split the HTTP response and inject arbitrary headers or even an HTML/JavaScript body, leading to reflected cross-site scripting (XSS), open redirect or other attacks.\n\nThe issue documented in CVE-2010-4410 https://www.cve.org/CVERecord?id=CVE-2010-4410 is related but the fix was incomplete.\n\nImpact\n\nBy injecting %0A (newline) into a query string parameter, an attacker can:\n\n  *  Break the current HTTP header\n  *  Inject a new header or entire body\n  *  Deliver a script payload that is reflected in the server’s response\nThat can lead to the following attacks:\n\n  *  reflected XSS\n  *  open redirect\n  *  cache poisoning\n  *  header manipulation","status":"published","published":"2025-08-29T03:30:50Z","modified":"2025-08-29T15:31:44Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-113"],"updated_at":"2026-11-02T15:03:27.857466Z"}],"nvd":[{"id":"CVE-2025-40927","description":"CGI::Simple versions before 1.282 for Perl has a HTTP response splitting flaw\nThis vulnerability is a confirmed HTTP response splitting flaw in CGI::Simple that allows HTTP response header injection, which can be used for reflected XSS or open redirect under certain conditions.\n\nAlthough some validation exists, it can be bypassed using URL-encoded values, allowing an attacker to inject untrusted content into the response via query parameters.\n\n\n\nAs a result, an attacker can inject a line break (e.g. %0A) into the parameter value, causing the server to split the HTTP response and inject arbitrary headers or even an HTML/JavaScript body, leading to reflected cross-site scripting (XSS), open redirect or other attacks.\n\nThe issue documented in CVE-2010-4410 https://www.cve.org/CVERecord?id=CVE-2010-4410 is related but the fix was incomplete.\n\nImpact\n\nBy injecting %0A (newline) into a query string parameter, an attacker can:\n\n  *  Break the current HTTP header\n  *  Inject a new header or entire body\n  *  Deliver a script payload that is reflected in the server’s response\nThat can lead to the following attacks:\n\n  *  reflected XSS\n  *  open redirect\n  *  cache poisoning\n  *  header manipulation","status":"published","published":"2025-08-29T01:15:34.553Z","modified":"2026-10-18T21:10:00.12Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-113"],"updated_at":"2026-11-02T14:11:26.200344Z"}],"osv":[{"id":"CVE-2025-40927","title":"CGI::Simple versions 1.281 and earlier for Perl has a HTTP response splitting flaw","description":"CGI::Simple versions before 1.282 for Perl has a HTTP response splitting flaw\nThis vulnerability is a confirmed HTTP response splitting flaw in CGI::Simple that allows HTTP response header injection, which can be used for reflected XSS or open redirect under certain conditions.\n\nAlthough some validation exists, it can be bypassed using URL-encoded values, allowing an attacker to inject untrusted content into the response via query parameters.\n\n\n\nAs a result, an attacker can inject a line break (e.g. %0A) into the parameter value, causing the server to split the HTTP response and inject arbitrary headers or even an HTML/JavaScript body, leading to reflected cross-site scripting (XSS), open redirect or other attacks.\n\nThe issue documented in CVE-2010-4410 https://www.cve.org/CVERecord?id=CVE-2010-4410 is related but the fix was incomplete.\n\nImpact\n\nBy injecting %0A (newline) into a query string parameter, an attacker can:\n\n  *  Break the current HTTP header\n  *  Inject a new header or entire body\n  *  Deliver a script payload that is reflected in the server’s response\nThat can lead to the following attacks:\n\n  *  reflected XSS\n  *  open redirect\n  *  cache poisoning\n  *  header manipulation","status":"published","published":"2025-08-29T00:10:07.161Z","modified":"2026-10-28T02:30:41.085423085Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-113"],"updated_at":"2026-11-02T15:44:49.394967Z"},{"id":"DEBIAN-CVE-2025-40927","description":"CGI::Simple versions before 1.282 for Perl has a HTTP response splitting flaw This vulnerability is a confirmed HTTP response splitting flaw in CGI::Simple that allows HTTP response header injection, which can be used for reflected XSS or open redirect under certain conditions.  Although some validation exists, it can be bypassed using URL-encoded values, allowing an attacker to inject untrusted content into the response via query parameters.    As a result, an attacker can inject a line break (e.g. %0A) into the parameter value, causing the server to split the HTTP response and inject arbitrary headers or even an HTML/JavaScript body, leading to reflected cross-site scripting (XSS), open redirect or other attacks.  The issue documented in CVE-2010-4410 https://www.cve.org/CVERecord?id=CVE-2010-4410 is related but the fix was incomplete.  Impact  By injecting %0A (newline) into a query string parameter, an attacker can:    *  Break the current HTTP header   *  Inject a new header or entire body   *  Deliver a script payload that is reflected in the server’s response That can lead to the following attacks:    *  reflected XSS   *  open redirect   *  cache poisoning   *  header manipulation","status":"published","published":"2025-08-29T01:15:34.553Z","modified":"2026-10-23T17:47:43.177020238Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:45:46.998514Z"},{"id":"UBUNTU-CVE-2025-40927","description":"CGI::Simple versions before 1.282 for Perl has a HTTP response splitting flaw This vulnerability is a confirmed HTTP response splitting flaw in CGI::Simple that allows HTTP response header injection, which can be used for reflected XSS or open redirect under certain conditions. Although some validation exists, it can be bypassed using URL-encoded values, allowing an attacker to inject untrusted content into the response via query parameters. As a result, an attacker can inject a line break (e.g. %0A) into the parameter value, causing the server to split the HTTP response and inject arbitrary headers or even an HTML/JavaScript body, leading to reflected cross-site scripting (XSS), open redirect or other attacks. The issue documented in CVE-2010-4410 https://www.cve.org/CVERecord?id=CVE-2010-4410 is related but the fix was incomplete. Impact By injecting %0A (newline) into a query string parameter, an attacker can:   *  Break the current HTTP header   *  Inject a new header or entire body   *  Deliver a script payload that is reflected in the server’s response That can lead to the following attacks:   *  reflected XSS   *  open redirect   *  cache poisoning   *  header manipulation","status":"published","published":"2025-08-29T01:15:00Z","modified":"2026-05-20T16:23:24.375744563Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T16:55:46.53147Z"},{"id":"openSUSE-SU-2025:15625-1","title":"perl-CGI-Simple-1.282.0-1.1 on GA media","description":"These are all security issues fixed in the perl-CGI-Simple-1.282.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-10-11T00:00:00Z","modified":"2026-03-23T04:54:01.290343Z","updated_at":"2026-11-02T16:58:37.810934Z"}]}}