CVE-2026-13221: Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perlstudychunk.

— Launchpad

Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perlstudychunk

— Microsoft

Uncontrolled recursion in the ordered-JSON support of github.com/go-openapi/swag/jsonutils. Both the marshal and unmarshal paths of the stdlib and easyjson adapters recurse once per nesting level with no depth limit, so a deeply nested JSON document, or an equally deep in-memory JSONMapSlice passed to WriteJSON, drives the Go runtime to a non-recoverable "fatal error: stack overflow" and kills the process. The ordered-JSON path uses its own lexer instead of encoding/json and so does not benefit from the standard library decoder max-nesting-depth guard. Fixed in v0.27.1, which bounds nesting at 10000 levels. The same unbounded recursion is present in the pre-split root module github.com/go-openapi/swag, where the code lived in yaml.go until v0.24.0.

— IBM