CVE-2026-13221: Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk
Last updated 27 August 2026
Other sources
Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perlstudychunk
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.38.2-513 - Upgrade
Upgrade
debian/perlto a version that resolves this vulnerability.Fixed in 5.42.3-1 - Upgrade
Upgrade
Perlto a version that resolves this vulnerability.Fixed in 5.43.10Patch CVE-2026-13221
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13221?
The severity of CVE-2026-13221 is rated at 27.
How do I fix CVE-2026-13221?
To fix CVE-2026-13221, upgrade to Perl version 5.44 or later.
What versions of Perl are affected by CVE-2026-13221?
Perl versions through 5.43.9 are affected by CVE-2026-13221.
What type of vulnerability is CVE-2026-13221?
CVE-2026-13221 is classified as an Integer Overflow vulnerability.
What impact does CVE-2026-13221 have on regular expressions?
CVE-2026-13221 can cause silently incorrect regular expression matches when handling a large number of fixed string branches.