CVE-2010-2761: Andy Armstrong Cgi-Simple

Medium severity, CVSS 4.3. EPSS: 2.7% chance of exploitation in the next 30 days.

The multipart_init function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier uses a hardcoded value of the MIME boundary string in multipart/x-mixed-replace content, which allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input that contains this value, a different vulnerability than CVE-2010-3172.

Affected products

• Andy Armstrong Cgi-Simple: up to and including 1.112; version 0.078 only; version 0.079 only; version 0.080 only; version 0.081 only; version 0.082 only; …
• Andy Armstrong Cgi.pm: up to and including 3.49; version 1.4 only; version 1.42 only; version 1.43 only; version 1.44 only; version 1.45 only; …

Published 2010-12-06. Last modified 2026-06-16.