CVE-2026-14895: String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service
String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service.
The trim and rtrim functions stripped trailing whitespace with s/\s$//u. Because \s matches greedily and the $ anchor fails whenever a non-whitespace character follows the whitespace, the regex engine retries the match at each offset of a long whitespace run, producing quadratic backtracking. The fix replaces \s$ with \s+$.
Any caller that passes untrusted input to trim or rtrim can trigger CPU exhaustion with a string containing a long run of whitespace.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Perl String::Utilto a version that resolves this vulnerability.Fixed in 1.36 - Configuration
Update the trim/rtrim implementation to use `s/\s+//u` (the fix replaces `\s*$` with `\s+$`) instead of stripping trailing whitespace using `s/\s*$//u`.
String::Util (trim/rtrim) regex used for stripping trailing whitespace = replace `s/\s*$//u` with `s/\s+//u`
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14895?
The severity of CVE-2026-14895 is rated at 28.
How do I fix CVE-2026-14895?
To fix CVE-2026-14895, upgrade to String::Util version 1.36 or later.
What vulnerability does CVE-2026-14895 address?
CVE-2026-14895 addresses a regular expression denial of service in String::Util versions before 1.36.
Which functions in String::Util are affected by CVE-2026-14895?
The trim and rtrim functions in String::Util are affected by CVE-2026-14895.
Is CVE-2026-14895 relevant to all Perl applications?
CVE-2026-14895 is relevant only to Perl applications using vulnerable versions of String::Util.