CVE-2026-77781: Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys
Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys.
The FETCH, EXISTS and DELETE methods throw an exception when on malformed regular expressions.
Each method falls back to a regex match when the key is not already stored in the hash, compiling the caller's key with a bare qr// and no eval guard. A key that is not a valid regular expression pattern, such as a single unmatched bracket, dies.
An application that looks up externally supplied strings in a tied hash will die on an invalid key.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tie::Hash::Regexto a version that resolves this vulnerability.Fixed in 2.0.0Patch CVE-2026-77781
Event History
Frequently Asked Questions
Which applications are realistically exposed to this failure?
Applications are exposed when they use a tied Tie::Hash::Regex hash and pass externally supplied strings to FETCH, EXISTS, or DELETE. The failure occurs when the supplied key is not already present and is malformed as a regular expression.
What input is needed to trigger the exception?
An attacker or other input source only needs to provide an invalid regular-expression pattern as a lookup key, such as a single unmatched bracket. The affected methods compile the key as a regular expression without an eval guard, causing the application to die.
Are all tied-hash lookups affected?
No. The vulnerable regex fallback is used when the requested key is not already stored in the hash. FETCH, EXISTS, and DELETE are the affected methods under that condition.
How can I determine whether an application is affected?
Check whether it uses Tie::Hash::Regex before version 2.0.0 and performs FETCH, EXISTS, or DELETE operations with externally controlled lookup keys. A malformed regex key that is absent from the hash can reproduce the exception.