CVE-2026-13221: Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk
Last updated 9 September 2026
Other sources
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perlstudychunk.
— Launchpad
Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perlstudychunk
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.38.2-513 - Upgrade
Upgrade
debian/perlto a version that resolves this vulnerability.Fixed in 5.42.3-1 - Upgrade
Upgrade
Perlto a version that resolves this vulnerability.Fixed in 5.40.5 - Upgrade
Upgrade
Perlto a version that resolves this vulnerability.Fixed in 5.42.3 - Upgrade
Upgrade
Perlto a version that resolves this vulnerability.Fixed in 5.44.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13221?
The severity of CVE-2026-13221 is rated at 27.
How do I fix CVE-2026-13221?
To fix CVE-2026-13221, upgrade to Perl version 5.44 or later.
What versions of Perl are affected by CVE-2026-13221?
Perl versions through 5.43.9 are affected by CVE-2026-13221.
What type of vulnerability is CVE-2026-13221?
CVE-2026-13221 is classified as an Integer Overflow vulnerability.
What impact does CVE-2026-13221 have on regular expressions?
CVE-2026-13221 can cause silently incorrect regular expression matches when handling a large number of fixed string branches.