Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains.

Net::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack (at least with larger TCP responses), leading to a potential Denial of Service.

The guard $link < $offset prevents forward and circular chains, but still allows arbitrarily long backward chains. The per-offset cache ($cache) is populated at the start of each call and short-circuits only re-traverses of the same offset - the initial descent through a fresh chain still recurses at full depth.

A crafted packet can chain two-byte compression pointers so that each one points two bytes earlier than the previous, producing a chain length of offset / 2. For the 14-bit pointer field (max offset 16383) this gives up to ~8191 recursive frames. For a TCP DNS message the limit is the 16-bit length field (~32767 frames). Perl's default C stack handles only a few thousand frames; beyond that the process receives SIGSEGV or similar, which is a denial-of-service for any application parsing untrusted DNS data.

The vulnerability is triggered by Net::DNS::Packet->new(\$wire) i.e. any point where the library decodes a DNS message from the network.

Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in getrequesttoken.

Passing a callback to the constructor selects OAuth 1.0a. getrequesttoken then revokes that choice when the request token response omits oauthcallbackconfirmed, with no exception, no warning and no option to require 1.0a. The access token request is built from the OAuth 1.0 message class, which has no verifier parameter, so oauthverifier is dropped from the request even when getaccesstoken was passed one.

oauthverifier is the binding that OAuth 1.0a added between the authorization step and the token exchange. An application that asked for 1.0a and gets 1.0 is open to OAuth 1.0 session fixation, where an attacker obtains a request token, has the victim authorize it, and then completes the exchange themselves, linking the victim's provider account to a session the attacker controls. No attacker action sets up the downgrade: a provider that does not confirm the callback is enough.

Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP.

The Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource::RandomnumbersInfo remote sources are accessed over plain HTTP.

The Data::Entropy::RawSource::RandomOrg integrity check trivially matches any non-empty byte string.

Any on-path attacker, such as open WiFi, a compromised ISP, captive portal, or a hostile egress proxy substitutes the response and thereby chooses the bytes returned by randbits and randint for every application that selected one of these sources via withentropysource. The checkbuf method response is equally attacker-controlled, so the retry/sleep behaviour is steerable too.

Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because newfromxml reads assertion identity with document-wide XPath instead of the signed subtree.

newfromxml reads the NameID, attribute values, SessionIndex, audience and other identity fields with document-wide XPath, such as //saml:Assertion/saml:AttributeStatement/saml:Attribute and //saml:Subject/saml:NameID, which select the first matching element in document order rather than the element covered by the verified signature. handleresponse confirms that a signature is present and, when a cacert is configured, that it chains to the CA, but XML::Sig verifies only the element named by the signature's Reference URI, so unsigned sibling assertions in the same document are not covered. An attacker who holds any one IdP-signed assertion can add an unsigned attacker-authored assertion earlier in document order; the signature still verifies and the document-order XPath returns the attacker's NameID and attributes.

Any caller that passes an untrusted Response to newfromxml can accept identity fields from an assertion the IdP never signed, even when a cacert trust anchor is configured, so a party holding one valid IdP-signed assertion can authenticate as an arbitrary user.

XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID.

getsignedxml() in lib/XML/Sig.pm, called from verify(), resolves the SignedInfo Reference/@URI to a node with the XPath expression "//[@ID='$id']" and returns the first node of the resulting node set. A document in which two elements share that ID value is accepted: the digest and signature are checked against whichever element comes first in document order, and the duplicate is not detected.

Such a document verifies successfully while an application that resolves the same ID independently can read the second, attacker supplied element; in a SAML2 context this places the contents of an Assertion under attacker control.

GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in makefilehandle.

Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUESTURI concatenation in call.

When the rewrite base is a plain string, the REQUESTURI is appended to it, with no check that the path starts with a forward slash ('/').

When the rewrite base does not contain a path (which is the standard given in the SYNOPSIS), an attacker can create a request that changes the hostname. A request target starting with an at-sign ('@') changes the base to a RFC 3986 userinfo component.

For example, a rewrite base of "https://example.com" with the submitted request "GET @192.168.1.2/" will send a request to "https://example.com@192.168.1.2/", with the rendered content returned to the attacker.

This allows an attacker to access internal or restricted hosts that only the webserver has access to.

Data::HashMap::Shared versions before 0.14 for Perl allow an out-of-bounds read via an unvalidated arena offset and length in shmstrcopy.

The attach-time validator shmvalidateheader checks the header scalars and region layout against the file size, but does not validate the array contents it then trusts. shmstrcopy does memcpy(dst, arena + off, len) with off and len read raw from the mmap'd segment and unbounded, on the each, keys, values, pop, shift, take, swap, drain and cursor paths. The get path bounds off and len separately and is not affected.

A local peer that can write the backing file can leave the header valid while poisoning a record's offset and length, so iterating or draining the map copies a file-controlled offset and length out of the arena, reading adjacent memory or crashing the process.

GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets.

The random method creates the challenge text used for the CAPTCHA by sampling characters from an array using Perl's built-in rand function, and generates a (by default) six-character string.

The built-in rand function is unsuitable for security applications because it is predictable and reversible.

======================================================================== CVE-2026-57075 CPAN Security Group ========================================================================

CVE ID: CVE-2026-57075 Distribution: YAML-Syck Versions: before 1.47

MetaCPAN: https://metacpan.org/dist/YAML-Syck VCS Repo: https://github.com/toddr/YAML-Syck

YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syckbase64dec

Description ----------- YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syckbase64dec.

The base64 decoder in the bundled libsyck indexes the 256-entry static table b64xtable with a signed char, so any !!binary byte >= 0x80 sign-extends to a negative index and reads before the table. The decoder receives the raw bytes of any !!binary node, a standard YAML type not gated by $LoadBlessed or $LoadCode, so it is reached on the default Load path.

Any caller that runs Load or LoadFile on an untrusted document containing a !!binary scalar with a high-bit byte triggers the read, and the value read can surface in the decoded result.

Problem types ------------- - CWE-125 Out-of-bounds Read

Solutions --------- Upgrade to YAML-Syck 1.47 or later.

References ---------- https://metacpan.org/release/TODDR/YAML-Syck-1.47/changes https://github.com/toddr/YAML-Syck/commit/44c90a109ec3215ee7ce747bd11209835e123d8b.patch

-- Paul Johnson - paul () pjcj net

This module implements a Perl interface to the GNOME libxml2 library which provides interfaces for parsing and manipulating XML files. This module allows Perl programmers to make use of the highly capable validating XML parser and the high performance DOM implementation.Security Fix(es): perl-XML-LibXML: XML::LibXML: Denial of Service via truncated UTF-8 in XML node names (CVE-2026-8177) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Imager::File::JPEG versions before 1.003 for Perl leak heap memory when reading a JPEG with repeated APP13 markers in ireadjpegwiol.

ireadjpegwiol walks the marker list libjpeg returns and, for each APP13 marker, allocates a new buffer with iptcitext = mymalloc(...) and overwrites the previous pointer without freeing it. Only the final payload is later turned into a Perl scalar and freed, so a JPEG with N such markers leaks the first N-1 payloads on every read.

In a long-lived process, such as an upload or thumbnailing service, repeated reads accumulate these leaks and exhaust available memory, a denial of service.

The same handler ships bundled in the Imager distribution, where versions before 1.032 are affected and the fix ships in 1.032.

Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth 2.0 state parameter.

RequestTokenV2 builds the provider authorization redirect without issuing a state value, and AccessTokenV2 exchanges the callback code and registers the resulting token into the session (registersession) without verifying that the callback corresponds to an authorization request this session initiated.

Any application that uses this middleware for OAuth 2.0 login is exposed to login cross-site request forgery: because the callback is not bound to the session that began the flow, an attacker who starts an authorization with their own provider account can deliver the resulting callback to a victim, causing the victim's session to complete the attacker's authorization and associating the attacker's provider identity and access token with that session. Where the application persists this as an account link, the attacker may retain access to the victim's account through their own provider credentials.

CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.

======================================================================== CVE-2025-40928                                       CPAN Security Group ========================================================================

CVE ID:  CVE-2025-40928   Distribution:  JSON-XS       Versions:  before 4.04

MetaCPAN:  https://metacpan.org/dist/JSON-XS       VCS Repo:  https://cvs.schmorp.de/JSON-XS/

JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact

Description ----------- JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact

Problem types ------------- - CWE-122 Heap-based Buffer Overflow

Solutions --------- Update to 4.04, or apply the provided patch

References ---------- https://metacpan.org/release/MLEHMANN/JSON-XS-4.03/source/XS.xs#L256 https://security.metacpan.org/patches/J/JSON-XS/4.03/CVE-2025-40928-r1.patch

Credits ------- Michael Hudak of rasotec, reporter

Crypt::CBC versions between 1.21 and 3.05 for Perl may use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.

This issue affects operating systems where "/dev/urandom'" is unavailable.  In that case, Crypt::CBC will fallback to use the insecure rand() function.

CGI::Simple versions before 1.282 for Perl has a HTTP response splitting flaw This vulnerability is a confirmed HTTP response splitting flaw in CGI::Simple that allows HTTP response header injection, which can be used for reflected XSS or open redirect under certain conditions.

Although some validation exists, it can be bypassed using URL-encoded values, allowing an attacker to inject untrusted content into the response via query parameters.

As a result, an attacker can inject a line break (e.g. %0A) into the parameter value, causing the server to split the HTTP response and inject arbitrary headers or even an HTML/JavaScript body, leading to reflected cross-site scripting (XSS), open redirect or other attacks.

The issue documented in CVE-2010-4410 https://www.cve.org/CVERecord?id=CVE-2010-4410 is related but the fix was incomplete.

Impact

By injecting %0A (newline) into a query string parameter, an attacker can:

Break the current HTTP header Inject a new header or entire body Deliver a script payload that is reflected in the server’s response That can lead to the following attacks:

reflected XSS open redirect cache poisoning header manipulation

issafe in the File::Temp module for Perl does not properly handle symlinks.

======================================================================== CVE-2011-10007 CPAN Security Group ========================================================================

CVE ID: CVE-2011-10007 Distribution: File-Find-Rule Versions: through 0.34

MetaCPAN: https://metacpan.org/dist/File-Find-Rule VCS Repo: https://github.com/richardc/perl-file-find-rule

File::Find::Rule through 0.34 for Perl is vulnerable to Arbitrary Code Execution when grep() encounters a crafted file name

Description ----------- File::Find::Rule through 0.34 for Perl is vulnerable to Arbitrary Code Execution when grep() encounters a crafted filename.

A file handle is opened with the 2 argument form of open() allowing an attacker controlled filename to provide the MODE parameter to open(), turning the filename into a command to be executed.

Example:

$ mkdir /tmp/poc; echo > "/tmp/poc/|id" $ perl -MFile::Find::Rule \ -E 'File::Find::Rule->grep("foo")->in("/tmp/poc")' uid=1000(user) gid=1000(user) groups=1000(user),100(users)

Problem types ------------- - CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Solutions --------- Users should update to a fixed version when available, or apply the patch provided in the references section, or use a patched version provided by their OS distribution

References ---------- https://metacpan.org/release/RCLAMP/File-Find-Rule-0.34/source/lib/File/Find/Rule.pm#L423 https://rt.cpan.org/Public/Bug/Display.html?id=64504 https://github.com/richardc/perl-file-find-rule/pull/4 https://github.com/richardc/perl-file-find-rule/commit/df58128bcee4c1da78c34d7f3fe1357e575ad56f.patch

Timeline -------- - 2011-01-04: A bug was reported by Kevin Ryde to the upstream RT bugtracker described as "grep() can truncate files". - 2025-06-04: CPANSec became aware of the bug and started triage. Code execution impact was confirmed, a patch was made, and the author, the distros list and additional downstream vendors were notified.

Multiple cross-site scripting (XSS) vulnerabilities in CPAN WWW::Form before 1.13 allow remote attackers to inject arbitrary web script or HTML via unknown vectors.

UI-Dialog 1.09 and earlier allows remote attackers to execute arbitrary commands.

The Batch::BatchRun module 1.03 for Perl does not properly handle temporary files.

Parallel::ForkManager module before 1.0.0 for Perl does not properly handle temporary files.

Hi,

The CPAN Security WG was recently informed that the Perl module Spreadsheet::ParseExcel 0.65 (and earlier) is vulnerable to arbitrary code execution.

Users should upgrade to version 0.66 as soon as possible.

Updated Version: https://metacpan.org/release/JMCNAMARA/Spreadsheet-ParseExcel-0.66

Patch: https://github.com/jmcnamara/spreadsheet-parseexcel/commit/bd3159277e745468e2c553417b35d5d7dc7405bc.patch

References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-7101 https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0019.md

Best, Stig

Safe.pm 2.26 and earlier (except 2.20 through 2.23 if using a threads-enabled Perl), when used in Perl 5.10.0 and earlier, may allow attackers to break out of safe compartment in (1) Safe::reval or (2) Safe::rdo using subroutine references, whose execution is delayed to happen outside of the safe compartment. If a victim was tricked into running a specially-crafted Perl script, using Safe extension module, it could lead to intended Safe module restrictions bypass, if the returned subroutine reference was called from outside of the compartment. Different vulnerability than CVE-2010-1168.

Solution: Ugrade to Safe.pm v2.27 or higher.

References: [1] http://search.cpan.org/~rgarcia/Safe-2.27/Safe.pm

Acknowledgements:

Red Hat would like to thank Tim Bunce for responsibly reporting this flaw. Upstream credits also Rafaël Garcia-Suarez for discovering of this issue.

Safe.pm 2.24 and earlier, when used in Perl 5.10.0 and earlier, may allow attackers to break out of safe compartment in (1) Safe::reval or (2) Safe::rdo using implicitly called methods (such as DESTROY or AUTOLOAD) on implicitly blessed Perl objects, returned as a result of unsafe code evaluation. These methods could have been executed unrestricted by Safe, when such objects were accessed or destroyed. If a victim was tricked into running a specially-crafted Perl script, using Safe extension module, it could lead to intended Safe module restriction bypass. Different vulnerability than CVE-2010-1447.

Solution: Upgrade to Safe.pm v2.25 or higher.

References: [1] http://search.cpan.org/~rgarcia/Safe-2.27/Safe.pm

Acknowledgements:

Red Hat would like to thank Tim Bunce for responsibly reporting this issue. Upstream acknowledges Nick Cleaton as the original reporter.

On Wed, May 03, 2023 at 03:41:26PM -0400, Jeffrey Walton wrote: On Wed, May 3, 2023 at 3:21 PM Reid Sutherland <reid () thirddimension net> wrote: On 4/29/23 06:04, Stig Palmquist wrote: - CVE-2023-31484 for CPAN.pm - CVE-2023-31485 for GitLab::API::v4 - CVE-2023-31486 for HTTP::Tiny ... Who actually decides when something receives a CVE? This can be used to defame projects and products as in this case. "Who decides" can be a tricky question.

Several organizations issue CVEs, like Red Hat and Gentoo. A bug usually has to meet a criteria, like falling into a CWE category, to be issued by the organization. Actually, Gentoo is NOT a CNA, and thus cannot issue CVEs. You can also get them from Mitre's site. In the case of Mitre, it is the person who requests the CVE.

Some CVE's are tenuous or questionable. You often see this from folks trying to pad their resume. For example, a researcher may request a CVE for a behavior that requires elevated privileges. In this case, someone who is Root on Linux or Administrator on Windows can already do the damage, so the behavior in question that happens with privileges is not really interesting.

In the case of HTTP::Tiny, the default configuration and behavior is running afoul of https://cwe.mitre.org/data/definitions/295.html and https://cwe.mitre.org/data/definitions/319.html. In this case, the industry believes comms should use HTTPS and the name hostname should be validated.

Jeff