CVE catalog

CVE-2011-2766

libfcgi-perl: CVE-2011-2766

Severity: Medium
Published: Sep 23, 2011, 10:55:03 AM UTC
Source: [NVD] · [CVE record]
EPSS: 7.24% · Oct 25, 2026

The FCGI (aka Fast CGI) module 0.70 through 0.73 for Perl, as used by CGI::Fast, uses environment variable values from one request during processing of a later request, which allows remote attackers to bypass authentication via crafted HTTP headers.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	libfcgi-perl	sid	`0.82+ds-3`	fixed
Debian	libfcgi-perl	forky	`0.82+ds-3`	fixed
Debian	libfcgi-perl	trixie	`0.82+ds-3`	fixed
Debian	libfcgi-perl	bookworm	`0.82+ds-2`	fixed
Opensuse	FastCGI	tumbleweed	`2.4.0-171.10`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	libfcgi-perl	source	sid	`0.73-2`	not yet assigned	Not reported	[607479]
Debian	libfcgi-perl	source	forky	`0.73-2`	not yet assigned	Not reported	[607479]
Debian	libfcgi-perl	source	trixie	`0.73-2`	not yet assigned	Not reported	[607479]
Debian	libfcgi-perl	source	bookworm	`0.73-2`	not yet assigned	Not reported	[607479]
Opensuse	FastCGI	rpm	tumbleweed	`2.4.0-171.10`	Not reported	OPENSUSE-SU-2024:10387-1	Not reported

[Debian bug #607479]

OpenFactory catalog packages

[openSUSE Tumbleweed]

[FastCGI-devel]Unknown
Source package: [FastCGI]
Details (1)
- 2.4.7-1.7 · x86_64 · tumbleweed
  Unknown · Fixed: 2.4.0-171.10
  Version impact unknown
  dsa · FastCGI · opensuse · tumbleweed
[libfcgi0]Unknown
Source package: [FastCGI]
Details (1)
- 2.4.7-1.7 · x86_64 · tumbleweed
  Unknown · Fixed: 2.4.0-171.10
  Version impact unknown
  dsa · FastCGI · opensuse · tumbleweed
[perl-FCGI]Unknown
Source package: [FastCGI]
Details (1)
- 2.4.7-1.7 · x86_64 · tumbleweed
  Unknown · Fixed: 2.4.0-171.10
  Version impact unknown
  dsa · FastCGI · opensuse · tumbleweed
[FastCGI]Fixed
Source package: [FastCGI]
Details (1)
- 2.4.7-1.7 · x86_64 · tumbleweed
  Fixed · Fixed: 2.4.0-171.10
  dsa · FastCGI · opensuse · tumbleweed

[Debian 12 (Bookworm)]

[libfcgi-perl]Fixed
Details (2)
- 0.82+ds-2 · amd64 · bookworm
  Fixed · Fixed: 0.73-2
  dsa · libfcgi-perl · debian · bookworm; dsa · libfcgi-perl · debian · 12
- 0.82+ds-2 · arm64 · bookworm
  Fixed · Fixed: 0.73-2
  dsa · libfcgi-perl · debian · bookworm; dsa · libfcgi-perl · debian · 12

[Debian 13 (Trixie)]

[libfcgi-perl]Fixed
Source package: [libfcgi-perl]
Details (2)
- 0.82+ds-3+b2 · amd64 · trixie
  Fixed · Fixed: 0.73-2
  dsa · libfcgi-perl · debian · 13
- 0.82+ds-3+b2 · arm64 · trixie
  Fixed · Fixed: 0.73-2
  dsa · libfcgi-perl · debian · 13

Observed: Oct 23, 2026, 5:05:30 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]