CVE-2010-2761: The multipart_init function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier uses

Q: How do I fix CVE-2010-2761?

cgi.pm: upgrade to newer than 3.49; cgi-simple: upgrade to newer than 1.112. Exact commands for each OS are on this page.

Q: Is CVE-2010-2761 being exploited?

CVE-2010-2761 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2010-2761 affect?

CVE-2010-2761 affects cgi.pm, cgi-simple. Severity is medium (CVSS 4.3). The multipart_init function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier uses a hardcoded value of the MIME boundary string in multipart/x-mixed-replace content, which allows remote attackers to inject arbitr

Q: How urgent is CVE-2010-2761?

Priority 37/100. No elevated risk signals yet.

Routine

MEDIUM 4.3UPGRADEUPGRADE

CVE-2010-2761 is a medium-severity flaw (CVSS 4.3) affecting cgi.pm, cgi-simple. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

The multipart_init function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier uses a hardcoded value of the MIME boundary string in multipart/x-mixed-replace content, which allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input that contains this value, a different vulnerability than CVE-2010-3172.

Why this priority

No elevated risk signals yet

A fixed release or distro patch exists.

Risk facts

CVSS score	4.3 (Medium)
EPSS exploit chance	2.7% (top 14%)
CISA exploited list	No
Weakness	CWE-94
Published	2010-12-06
Last modified	2026-06-16

Publisher (CNA): MITRE · Vendor: andy armstrong

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2010-12-06 20:12 UTCPublished CVE record published
2026-06-16 23:21 UTCUpdated Record last modified

andy armstrong cgi.pm UPGRADE

Affected: <= 3.49 · 1.4 · 1.42 · 1.43 · 1.44 · 1.45 · 1.50 · 1.51

Fixed in: newer than 3.49

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy cgi.pm || rpm -q cgi.pm || cgi.pm --version

2. UPGRADE to newer than 3.49 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade cgi.pm

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade cgi.pm

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

andy armstrong cgi-simple UPGRADE

Affected: <= 1.112 · 0.078 · 0.079 · 0.080 · 0.081 · 0.082 · 0.83 · 1.0

Fixed in: newer than 1.112

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy cgi-simple || rpm -q cgi-simple || cgi-simple --version

2. UPGRADE to newer than 1.112 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade cgi-simple

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade cgi-simple

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2010-2761?

cgi.pm: upgrade to newer than 3.49; cgi-simple: upgrade to newer than 1.112. Exact commands for each OS are on this page.

Is CVE-2010-2761 being exploited?

CVE-2010-2761 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2010-2761 affect?

CVE-2010-2761 affects cgi.pm, cgi-simple. Severity is medium (CVSS 4.3). The multipart_init function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier uses a hardcoded value of the MIME boundary string in multipart/x-mixed-replace content, which allows remote attackers to inject arbitr

How urgent is CVE-2010-2761?

Priority 37/100. No elevated risk signals yet.

Related CVEs

CVE-2012-5526 MEDIUM 5.0 UPGRADE CGI.pm module before 3.63 for Perl does not properly escape newlines in (1) Set-Cookie or (2) P3P headers, whi
CVE-2010-4411 MEDIUM 4.3 UPGRADE Unspecified vulnerability in CGI.pm 3.50 and earlier allows remote attackers to inject arbitrary HTTP headers
CVE-2010-4410 MEDIUM 4.3 UPGRADE UPGRADE CRLF injection vulnerability in the header function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple
CVE-2003-0615 MEDIUM 4.3 DOWNGRADE DOWNGRADE Cross-site scripting (XSS) vulnerability in start_form() of CGI.pm allows remote attackers to insert web scrip

References

← Back to latest CVEs