Latest vulnerabilities for vendor "perl"

Perl Data::MuForm::LocalizerData::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because load_lexicon interpolates the language attribute into the catalog filename

Risk 57

Severity

8.2

Trending

Week

First published (updated )

CVE-2026-13048

oss-secCVE-2026-19487: Perl versions from 5.9.4 befo5.41.9 produce incorct gular expssion match sults when a stale failuflag ends the Aho-Corasick pscan early in S_find_byclass

First published (updated )

https://seclists.org/oss-sec/2026/q3/480

Perl PerlPerl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass

Risk 28

Severity

5.3

Trending

Week

First published (updated )

CVE-2026-19487

Perl DBICode Injection

Risk 33

Severity

7

First published (updated )

REDHAT-BUG-2513963

Perl PerlPerl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch

Risk 39

Severity

5.7

First published (updated )

CVE-2026-15534

Perl Crypt::OpenSSL::PKCS12Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute via a zero length BMPSTRING attribute

Risk 43

Severity

7.5

First published (updated )

CVE-2026-17510

Perl Archive::TarImportant: perl-Archive-Tar security update

Risk 26

First published (updated )

Advisory

RHSA-2026:49523

Perl Data::Intern::SharedData::Intern::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated slot, reverse and arena indices in si_idx_find

Risk 66

Severity

9.1

First published (updated )

CVE-2026-59145

Perl Data::RingBuffer::SharedData::RingBuffer::Shared versions before 0.04 for Perl allow a stack buffer overflow via an unvalidated elem_size in ring_read_seq

Risk 86

Severity

9.8

First published (updated )

CVE-2026-59144

Perl Net::DNSNet::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR

Risk 90

Severity

9.8

First published (updated )

CVE-2026-64193

Perl HTTP::DateHTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date

Risk 46

Severity

7.5

First published (updated )

CVE-2026-14741

Perl Dancer::Plugin::Auth::GoogleDancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled

Risk 71

Severity

8.2

First published (updated )

CVE-2026-13410

oss-secCVE-2026-57076: YAML::Syck versions befo1.47 for Perl allow a heap use-after-fe via an anchor name used as an anchors-table key in syck_hdlr_add_anchor

First published (updated )

https://seclists.org/oss-sec/2026/q3/160

Perl YAML::SyckYAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key in syck_hdlr_add_anchor

Risk 73

Severity

7.8

First published (updated )

CVE-2026-57076

Perl HTML::BareHTML::Bare versions through 0.04 for Perl have an unbounded character lookahead

Risk 70

Severity

9.1

First published (updated )

CVE-2026-57073

Perl HTML::BareHTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes

Risk 46

Severity

7.5

First published (updated )

CVE-2026-13397

Perl Perl 5.44End of life details

EOL

Jul 15, 2029

First published (updated )

EOL-perl-5.44

Perl DBIDBI versions before 1.651 for Perl do not enforce statement handle consistency with the row

Risk 70

Severity

9.1

First published (updated )

CVE-2026-60082

Perl DBI::ProfileDataDBI::ProfileData versions before 1.651 for Perl do not limit the path index

Risk 46

Severity

7.5

First published (updated )

CVE-2026-60081

Perl DBD::FileDBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location

Risk 60

Severity

7.7

First published (updated )

CVE-2026-15392

oss-secCVE-2026-57432: Perl versions through 5.43.10 have an integer overflow in S_measu_struct leading to an out-of-bounds heap ad in pack and unpack

First published (updated )

https://seclists.org/oss-sec/2026/q3/127

oss-secCVE-2026-13221: Perl versions through 5.43.9 produce silently incorct gular expssion matches when an alternation of mothan 65535 fixed string branches is compiled into a trie in Perl_study_chunk

First published (updated )

https://seclists.org/oss-sec/2026/q3/126

Perl PerlPerl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk

Risk 70

Severity

9.1

First published (updated )

CVE-2026-13221

Perl PerlPerl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack

Risk 79

Severity

8.4

First published (updated )

CVE-2026-57432

Perl DBIDBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extre…

Risk 33

Severity

7

First published (updated )

REDHAT-BUG-2497916

Perl String::UtilString::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service

Risk 46

Severity

7.5

First published (updated )

CVE-2026-14895

Perl DBIDBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment

Risk 70

Severity

9.1

First published (updated )

CVE-2026-14740

Perl DBI DBIDBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders

Risk 86

Severity

9.8

First published (updated )

CVE-2026-14739

DBI DBIDBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile

Risk 84

Severity

8.8

First published (updated )

CVE-2026-14380

Perl Module::LoadModule::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded

Risk 86

Severity

9.8

First published (updated )

CVE-2011-10043

Trending

Vendor Risk Score

Software

Perl Data::MuForm::LocalizerData::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because load_lexicon interpolates the language attribute into the catalog filename

oss-secCVE-2026-19487: Perl versions from 5.9.4 befo5.41.9 produce incorct gular expssion match sults when a stale failuflag ends the Aho-Corasick pscan early in S_find_byclass

Perl PerlPerl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass

Perl DBICode Injection

Perl PerlPerl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch

Don't miss critical vulnerabilities

Perl Crypt::OpenSSL::PKCS12Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute via a zero length BMPSTRING attribute

Perl Archive::TarImportant: perl-Archive-Tar security update

Perl Data::Intern::SharedData::Intern::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated slot, reverse and arena indices in si_idx_find

Perl Data::RingBuffer::SharedData::RingBuffer::Shared versions before 0.04 for Perl allow a stack buffer overflow via an unvalidated elem_size in ring_read_seq

Perl Net::DNSNet::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR

Don't miss critical vulnerabilities

Perl HTTP::DateHTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date

Perl Dancer::Plugin::Auth::GoogleDancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled

oss-secCVE-2026-57076: YAML::Syck versions befo1.47 for Perl allow a heap use-after-fe via an anchor name used as an anchors-table key in syck_hdlr_add_anchor

Perl YAML::SyckYAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key in syck_hdlr_add_anchor

Perl HTML::BareHTML::Bare versions through 0.04 for Perl have an unbounded character lookahead

Don't miss critical vulnerabilities

Perl HTML::BareHTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes

Perl Perl 5.44End of life details

Perl DBIDBI versions before 1.651 for Perl do not enforce statement handle consistency with the row

Perl DBI::ProfileDataDBI::ProfileData versions before 1.651 for Perl do not limit the path index

Perl DBD::FileDBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location

Don't miss critical vulnerabilities

oss-secCVE-2026-57432: Perl versions through 5.43.10 have an integer overflow in S_measu_struct leading to an out-of-bounds heap ad in pack and unpack

oss-secCVE-2026-13221: Perl versions through 5.43.9 produce silently incorct gular expssion matches when an alternation of mothan 65535 fixed string branches is compiled into a trie in Perl_study_chunk

Perl PerlPerl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk

Perl PerlPerl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack

Perl DBIDBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extre…

Don't miss critical vulnerabilities

Perl String::UtilString::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service

Perl DBIDBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment

Perl DBI DBIDBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders

DBI DBIDBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile

Perl Module::LoadModule::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded

Don't miss critical vulnerabilities

Company

Resources

Contact