CVE-2010-4410: Andy Armstrong Cgi-Simple

Medium severity, CVSS 4.3. EPSS: 2.5% chance of exploitation in the next 30 days.

CRLF injection vulnerability in the header function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via vectors related to non-whitespace characters preceded by newline characters, a different vulnerability than CVE-2010-2761 and CVE-2010-3172.

Affected products

• Andy Armstrong Cgi-Simple: up to and including 1.112; version 0.078 only; version 0.079 only; version 0.080 only; version 0.081 only; version 0.082 only; …
• Andy Armstrong Cgi.pm: up to and including 3.49; version 1.4 only; version 1.42 only; version 1.43 only; version 1.44 only; version 1.45 only; …

Published 2010-12-06. Last modified 2026-06-16.