Your message dated Fri, 11 Sep 2026 16:07:05 +0000
with message-id <[email protected]>
and subject line Bug#1147198: fixed in libhtml-formhandler-perl 0.410002-1
has caused the Debian Bug report #1147198,
regarding libhtml-formhandler-perl: CVE-2026-19872 CVE-2026-85484
CVE-2026-85485 CVE-2026-85630
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1147198: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1147198
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: libhtml-formhandler-perl
Version: 0.40068-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerabilities were published for libhtml-formhandler-perl.
CVE-2026-19872[0]:
| HTML::FormHandler versions before 0.410000 for Perl allow cross-site
| scripting via a submitted value rendered unescaped in an error
| message. The wrappers and renderers that emit a form's errors
| interpolate the error string straight into HTML with no escaping.
| Two of the library's own messages, no_match and not_allowed, splice
| the submitted value into that string, and a failing type constraint
| puts the rejected value into the message it builds, which
| _apply_actions hands to add_error. A field declared with a check
| regexp, a check list or a type constraint reaches those messages,
| with no custom validator and no non-default configuration. Errors
| rendered through an application's own escaping template layer rather
| than the library's rendering roles are not affected. A request over
| the network that submits markup to such a field gets it back live
| inside the error span, running script in the victim's origin. Re-
| rendering a rejected value later gives the stored variant.
CVE-2026-85484[1]:
| HTML::FormHandler versions before 0.410002 for Perl render option
| group labels and radio button labels into HTML without escaping.
| The Select, RadioGroup, CheckboxGroup and HorizCheckboxGroup widgets
| render a group label unescaped, Select into a label attribute and
| the other three into element content. RadioGroup also renders each
| radio button's own label unescaped. Any application whose option
| list is built from data rather than literals, using options_from, an
| options_fieldname method, or the DBIC model, allows attacker-
| influenced text in a label that can override the options or embed
| JavaScript in rendered pages.
CVE-2026-85485[2]:
| HTML::FormHandler versions before 0.410002 for Perl render some error
| messages into HTML without escaping. The Table form layout and the
| Bootstrap 2 and 3 wrappers splice each error string straight into the
| surrounding markup. Version 0.410000, the fix for CVE-2026-19872,
| escaped the equivalent values in the other layouts and wrappers, and
| 0.410002 extended that to these three. Error messages that contain attacker-
| influenced content such as rejected field values could embed
| JavaScript in rendered pages.
CVE-2026-85630[3]:
| HTML::FormHandler versions before 0.410002 for Perl render field
| attributes into HTML without escaping using the process_attrs
| method. Any application with fields or field labels where some
| attributes are built from data rather than literals allows attacker-
| influenced text in an attribute value that can override the field
| attributes or embed JavaScript in rendered pages. For example, the
| RadioGroup widget uses the process_attrs method via the
| render_option and wrap_radio methods.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-19872
https://www.cve.org/CVERecord?id=CVE-2026-19872
[1] https://security-tracker.debian.org/tracker/CVE-2026-85484
https://www.cve.org/CVERecord?id=CVE-2026-85484
[2] https://security-tracker.debian.org/tracker/CVE-2026-85485
https://www.cve.org/CVERecord?id=CVE-2026-85485
[3] https://security-tracker.debian.org/tracker/CVE-2026-85630
https://www.cve.org/CVERecord?id=CVE-2026-85630
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: libhtml-formhandler-perl
Source-Version: 0.410002-1
Done: gregor herrmann <[email protected]>
We believe that the bug you reported is fixed in the latest version of
libhtml-formhandler-perl, which is due to be installed in the Debian FTP
archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
gregor herrmann <[email protected]> (supplier of updated
libhtml-formhandler-perl package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 11 Sep 2026 17:29:23 +0200
Source: libhtml-formhandler-perl
Architecture: source
Version: 0.410002-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Perl Group <[email protected]>
Changed-By: gregor herrmann <[email protected]>
Closes: 1147198
Changes:
libhtml-formhandler-perl (0.410002-1) unstable; urgency=medium
.
* Import upstream version 0.410002.
In 0.410000:
- Fix CVE-2026-19872
In 0.410002:
- fix CVE-2026-85484
- fix CVE-2026-85485
- fix CVE-2026-85630
Closes: #1147198
* Drop whatis.patch, fixed upstream.
* Drop whatis-Field-Role-RequestToken.patch, fixed upstream.
* Drop CVE-2022-4993-r2.patch, fixed upstream.
* Convert debian/watch to version 5.
* Update years of packaging copyright.
* Update Build-Depends-Indep, Depends, and Recommends.
* Declare compliance with Debian Policy 4.7.4.
* Remove «Rules-Requires-Root: no», which is the current default.
* Remove «Priority: optional», which is the current default.
Checksums-Sha1:
7e6c99776409927e2bd7a1f1e7a19a15b59cc5d8 3632
libhtml-formhandler-perl_0.410002-1.dsc
418d4f93dc9a05b3d282d0f9e3a4ec9b2e111cdc 313138
libhtml-formhandler-perl_0.410002.orig.tar.gz
fc00090c7840a39a2f212fd51b9e54b64c10e679 4080
libhtml-formhandler-perl_0.410002-1.debian.tar.xz
af50a1745098a37babbe299a959b68abf119c3f7 857052
libhtml-formhandler-perl_0.410002-1.git.tar.xz
d8fc9cdcb02fc4ca22e8a86afa6e944aebebe74a 17748
libhtml-formhandler-perl_0.410002-1_source.buildinfo
Checksums-Sha256:
b0c3f7eb52db333355b771bc1d71181a93c575b426629d2c7f074cc966fe69e5 3632
libhtml-formhandler-perl_0.410002-1.dsc
c13de7e4f2c3995e50475c629529b654cf9e2c627bdd62e27ea48c7c6d63a9e5 313138
libhtml-formhandler-perl_0.410002.orig.tar.gz
7d9797a8f4e3cabdbf19673d2ce62286e928a210625af852539b82bd0f7e13fe 4080
libhtml-formhandler-perl_0.410002-1.debian.tar.xz
e857595139fd3e68131ad74b775b9250a2a9acf4bc00446064d080ee8bcc9f8e 857052
libhtml-formhandler-perl_0.410002-1.git.tar.xz
e7d26f943db1169865dde33023b42bbe421f0b4e3ad01a240364f155fe8cf9c5 17748
libhtml-formhandler-perl_0.410002-1_source.buildinfo
Files:
cdcde89623fc21a77ebadaedaae1d4f6 3632 perl optional
libhtml-formhandler-perl_0.410002-1.dsc
4bf9529152176230db8f0c00b1fc346a 313138 perl optional
libhtml-formhandler-perl_0.410002.orig.tar.gz
cdee7efb0b38cf41cd7306eade11e7ab 4080 perl optional
libhtml-formhandler-perl_0.410002-1.debian.tar.xz
1214d9a0b90824b1bc7b93e4cf3f2abd 857052 perl None
libhtml-formhandler-perl_0.410002-1.git.tar.xz
5f6c70848c38a383143dc48242ec850b 17748 perl optional
libhtml-formhandler-perl_0.410002-1_source.buildinfo
Git-Tag-Info: tag=0bc9df632d5dc5d0de51586358371976c02f751c
fp=d1e1316e93a760a8104d85fabb3a68018649aa06
Git-Tag-Tagger: gregor herrmann <[email protected]>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmqkIOAACgkQYG0ITkaD
wHkjfQ//SupLuCMrhXBF8SNQSYfbeYPTg2mgy4P3nAIinVL9LW9BkD9R8Bzkvhag
RXafv7uBLRSIL7FVUe0vMk/EqkNFGtnaP4SLm9xgBoACcWHUhRX8m9GbmlyLDLqq
1sDavLpao5Ij3snYoR+qaLO4/4nZRe7cSHBypmqqVqk4/8ULO6jwJOO/1zVO5tNd
qykuXJRcdat0tAe5SBeziJc0Hml5xXBebMaGP3EEQv7XtGfGg9dVMhpd4YK1MIQQ
BY2/DMTZabBh8mrLituahg3o0gQmjvVUu/pwoazJnLn0IoLakaTmBkstfEXWQFXl
lpxEdq6GAL5ngTz99/bGj4r9iOCMDUE5ndxcMFfzNAZ31vrU2c6PX47WICPjsXc4
q6TN1Mt2xOkd8ZjHs8/b+7Vz/BoL1yJHHGHG2irSezgAmZULlKBHRyvENDpuBrkx
5/u23hlbdfcRPpq6oD63I5x7XJdX94diw36XmmBAB8V621pozGfJOLE0CCTCdGky
h6VX1o0r73637vgYlxHdKzVVPLoP9TW1GuP3L5nUzxm77Qn8M3PwCBaJiccRLqPz
wQah60GgDtWTY0qchL7pg7IaU1g0Ic5EziWyi21Nytfsmo+ZbIijQgESjDhvTYYQ
vAaKIBIWWuwXewHzd1+Iu1UQ58GsE1chuzIgEGqxyCsq3oUQ758=
=YJoG
-----END PGP SIGNATURE-----
pgpbMkTn932e8.pgp
Description: PGP signature
--- End Message ---
