CVE-2026-13221: Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk
Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perlstudychunk
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.38.2-513 - Upgrade
Upgrade
perl/perlto a version that resolves this vulnerability.Fixed in 5.43.10Patch CVE-2026-13221 - Compensating control
If a regex pattern using an alternation with more than 65535 fixed string branches is used to gate an access or filtering decision, verify that access/filtering logic is not relying on potentially incorrect Perl regexp/trie matches for affected Perl versions before upgrading (CVE-2026-13221).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13221?
The severity of CVE-2026-13221 is rated at 27.
How do I fix CVE-2026-13221?
To fix CVE-2026-13221, upgrade to Perl version 5.44 or later.
What versions of Perl are affected by CVE-2026-13221?
Perl versions through 5.43.9 are affected by CVE-2026-13221.
What type of vulnerability is CVE-2026-13221?
CVE-2026-13221 is classified as an Integer Overflow vulnerability.
What impact does CVE-2026-13221 have on regular expressions?
CVE-2026-13221 can cause silently incorrect regular expression matches when handling a large number of fixed string branches.