URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep

Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys.

The FETCH, EXISTS and DELETE methods throw an exception when on malformed regular expressions.

Each method falls back to a regex match when the key is not already stored in the hash, compiling the caller's key with a bare qr// and no eval guard. A key that is not a valid regular expression pattern, such as a single unmatched bracket, dies.

An application that looks up externally supplied strings in a tied hash will die on an invalid key.

Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because loadlexicon interpolates the language attribute into the catalog filename.

loadlexicon builds the catalog path by appending Messages/$lang.po to the directory holding Localizer.pm, where $lang is the language attribute, with no check that it names a bare locale tag. A value holding ../ segments walks out of the message directory, so any readable path with a .po suffix is loaded. While parsing the catalog, extractheadermsgstr takes the Plural-Forms: header, prefixes $ to the bare words nplurals, plural and n, and passes the rest verbatim into a string that is evaluated: the nplurals form evaluates the header expression immediately, and the pluralcode form compiles it into a subroutine whose body runs when a plural message is localized. A header of nplurals=2; plural=(system('...'),0); therefore runs that command as the catalog loads. The evaluation inherits strict, so an expression that assigns to an undeclared variable fails to compile, while one built from calls alone does not.

An application that sets the language attribute from request data, an Accept-Language header or a locale parameter, and an attacker who can place a file with a .po suffix and chosen contents at a readable path, together give code execution as the application user. The message expansion path is not affected: expandnamed substitutes only the placeholder names the caller supplies, and manglevalue returns the value unchanged.

======================================================================== CVE-2026-19487 CPAN Security Group ========================================================================

CVE ID: CVE-2026-19487 Distribution: perl Versions: from 5.9.4 before 5.41.9

MetaCPAN: https://metacpan.org/dist/perl VCS Repo: https://github.com/Perl/perl5

Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in Sfindbyclass

Description ----------- Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in Sfindbyclass.

The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.

Example:

"ABCDE" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE "ABCDE" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed

An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.

Problem types ------------- - CWE-670 Always-Incorrect Control Flow Implementation

Solutions --------- Upgrade to Perl 5.42.0 or later, or apply the upstream patch.

References ---------- https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch https://github.com/Perl/perl5/issues/22892

Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in Sfindbyclass

Incomplete fix for CVE-2026-14380 in rhel 9.8.z and 10.2.z.

Details of CVE-2026-14380:

DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile.

When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation of the package name.

Any caller-influenced value that reaches the Profile attribute is therefore arbitrary Perl code execution, including calls to run system commands.

The Profile attribute can be set from three different sources that can carry untrusted data: the DBIPROFILE environment variable, a direct attribute assignment, and a DSN driver-attribute clause dbi:Driver(Profile=>SPEC):db.

An attacker controlling any of those inputs runs arbitrary Perl in the host process. The strongest remote position is a network-exposed DBI::Gofer / DBI::ProxyServer whose per-request DSN reaches the Profile attribute, letting a client execute code on the broker host.

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in Sregmatch

Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in printattribute via a zero length BMPSTRING attribute.

printattribute() sizes the destination buffer for a BMPSTRING attribute from its declared byte length with Renew(attribute, length, char). A zero length attribute makes that a zero size reallocation, which Perl implements as a free returning NULL, so the buffer pointer becomes NULL, the following strncpy copies nothing, and the caller dereferences NULL in the strlen() it passes to newSVpvn(). A zero length BMPSTRING is even length, so the ASN.1 decoder accepts it and the value reaches this code. The UTF8STRING, OCTET STRING and BIT STRING arms size on length + 1 or length 4 + 1 and are unaffected.

Any caller that passes an untrusted PKCS#12 file to infoashash() can crash the process. info() prints attribute values directly without sizing a buffer and is unaffected.

Archive::Tar provides an object oriented mechanism for handling tar files. It provides class methods for quick and easy files handling while also allowing for the creation of tar file objects for custom manipulation. If you have the IO::Zlib module installed, Archive::Tar will also support compressed or gzipped tar files.Security Fix(es): perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size (CVE-2026-9538) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in parsetime.

parsetime removes a time from anywhere in the string with the unanchored substitution s/$timerx/ /, where $timerx is an auto-generated alternation of time patterns reached through a leading (?:$atrx|^|\s+). The engine therefore retries the match at every position of an interior whitespace run: at each start position the leading \s+ consumes the rest of the run greedily, the time alternation fails because the run holds no digits, and the engine backtracks a space at a time across the run before advancing the start position, which is quadratic in the length of the run. No time need be present in the string for this to happen, only a long run of whitespace, and the parse time rises about fourfold for each doubling of the run: a few kilobytes of whitespace costs seconds of CPU per parse and tens of kilobytes costs minutes.

Any caller that passes an untrusted string of unbounded length to ParseDate(), Date::Manip::Date->parse() or ->parsetime() can be made to spend unbounded CPU in a single parse, a denial of service.

Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check.

The parse regexes capture year, month and day with the \d shorthand, which on a character string matches the whole Unicode decimal digit property \p{Nd} and not just [0-9]. Date::Manip::Base::check then validates the captured fields with numeric comparisons alone ($y<1 || $y>9999, $m<1 || $m>12, $d<1 || $d>$days), and parsecheck stores the numified fields ($y+0). Perl truncates a string at the first character that is not an ASCII digit, so a field whose leading characters are ASCII digits numifies to an in-range prefix and satisfies every test: a year field of three ASCII digits followed by U+0664 ARABIC-INDIC DIGIT FOUR numifies to 202, giving the year 0202, and one non-ASCII digit in the month or day field shifts those fields the same way. The hour, minute and second fields match explicit ASCII character classes (0?[0-9], [0-5][0-9]) and do not shift, though a non-ASCII digit in a fractional hour or minute field truncates the fraction.

Any caller that passes an untrusted character string to ParseDate() or Date::Manip::Date->parse() can get back a date that differs from the string it parsed, with no parse error. Where the parsed date gates logic such as an expiry check or a retention window, the shift goes unnoticed.

Data::Intern::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated slot, reverse and arena indices in siidxfind.

The attach-time validator sivalidateheader is thorough about the header and layout (magic, version, section offsets, totalsize, count and arenaused) but does not validate the three arrays it then trusts. Every lookup in siidxfind walks a triple indirection read straight from the mmap'd segment, arena[reverse[slots[i].id]], with no bound on slots[i].id against count, on the reverse[id] arena offset against arenaused, or on the arena record's length prefix.

A local peer that can write the backing file can leave the header valid while poisoning a slot id, a reverse offset or an arena length prefix, so an idof, intern or string lookup dereferences the chain out of bounds; because string() returns a file-controlled length of bytes from the arena, adjacent process memory can be disclosed.

Data::RingBuffer::Shared versions before 0.04 for Perl allow a stack buffer overflow via an unvalidated elemsize in ringreadseq.

The attach-time validator ringvalidateheader checks the capacity-overflow and totalsize consistency of the header but never caps elemsize against the destination size. ringreadseq does memcpy(out, ringslot(h, seq), elemsize) with elemsize read raw from the mmap'd segment, copying into a fixed 8-byte destination scalar. An elemsize larger than 8 bytes writes past the destination.

A local peer that can write the backing file can leave the header valid while setting a large elemsize, so the next read copies a file-controlled length into the fixed 8-byte stack buffer, corrupting adjacent stack frames.

Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR.

Net::DNS::RR::OPT::EXTENDEDERROR::decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:"<command>"} in EXTRA-TEXT.

HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parsedate.

Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled.

The default user agent is initialised with SSLverifymode explicitly disabled.

An attacker with network man-in-the-middle (MITM) capability between the Dancer application and googleapis.com can intercept the OAuth2 token exchange and userinfo fetch, return a forged accesstoken and user profile, and be logged in to the Dancer application as any Google user.

======================================================================== CVE-2026-57076 CPAN Security Group ========================================================================

CVE ID: CVE-2026-57076 Distribution: YAML-Syck Versions: before 1.47

MetaCPAN: https://metacpan.org/dist/YAML-Syck VCS Repo: https://github.com/toddr/YAML-Syck

YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key in syckhdlraddanchor

Description ----------- YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key in syckhdlraddanchor.

In the bundled libsyck an anchor name allocated by syckstrndup is stored both as node->anchor, freed when the node is freed, and as the key in the parser's anchors table. Freeing the node frees the shared key, and a later anchor redefinition makes stdelete compare against the freed key, so ststrcmp reads freed heap memory. Anchors are a standard YAML feature and need no special flags, so this is reached on the default Load path.

Any caller that runs Load or LoadFile on an untrusted document that redefines an anchor reaches the read of freed memory.

Problem types ------------- - CWE-416 Use After Free

Solutions --------- Upgrade to YAML-Syck 1.47 or later.

References ---------- https://metacpan.org/release/TODDR/YAML-Syck-1.47/changes https://github.com/toddr/YAML-Syck/commit/44c90a109ec3215ee7ce747bd11209835e123d8b.patch

-- Paul Johnson - paul () pjcj net

YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key in syckhdlraddanchor.

In the bundled libsyck an anchor name allocated by syckstrndup is stored both as node->anchor, freed when the node is freed, and as the key in the parser's anchors table. Freeing the node frees the shared key, and a later anchor redefinition makes stdelete compare against the freed key, so ststrcmp reads freed heap memory. Anchors are a standard YAML feature and need no special flags, so this is reached on the default Load path.

Any caller that runs Load or LoadFile on an untrusted document that redefines an anchor reaches the read of freed memory.

HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead.

The parsercparse function attempts to check for multicharacter strings such as "<![CDATA" or element terminators such as ">" without checking that the offsets are within the buffer.

Truncated strings such as "<a/" can trigger an out-of-bounds read.

Note that the latest version available on CPAN is version 0.02. Newer versions are available on the git repository.

HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes.

The parsercparse function never advances the attribute-parse state cursor on certain malformed attribute forms, looping forever.

Nameless attributes such as "<a ='c'>" or unbalanced quotes "<a b='''''''c'>" can trigger this condition.

Note that the latest version available on CPAN is version 0.02. Newer versions are available on the git repository.

End of life: 7/15/2029, Latest version: 5.44.0

DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row

DBI::ProfileData versions before 1.651 for Perl do not limit the path index

DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location

======================================================================== CVE-2026-57432 CPAN Security Group ========================================================================

CVE ID: CVE-2026-57432 Distribution: perl Versions: through 5.43.10

MetaCPAN: https://metacpan.org/dist/perl VCS Repo: https://github.com/Perl/perl5

Perl versions through 5.43.10 have an integer overflow in Smeasurestruct leading to an out-of-bounds heap read in pack and unpack

Description ----------- Perl versions through 5.43.10 have an integer overflow in Smeasurestruct leading to an out-of-bounds heap read in pack and unpack.

Smeasurestruct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSizet total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.

A template derived from untrusted input can read heap memory past the buffer and return it to the caller.

Problem types ------------- - CWE-190 Integer Overflow or Wraparound - CWE-125 Out-of-bounds Read

Solutions --------- Apply the upstream patches. The fix is included in the Perl 5.43.11 development release.

References ---------- https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch

======================================================================== CVE-2026-13221 CPAN Security Group ========================================================================

CVE ID: CVE-2026-13221 Distribution: perl Versions: through 5.43.9

MetaCPAN: https://metacpan.org/dist/perl VCS Repo: https://github.com/Perl/perl5

Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perlstudychunk

Description ----------- Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perlstudychunk.

When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.

A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.

Problem types ------------- - CWE-190 Integer Overflow or Wraparound

Solutions --------- Apply the upstream patch. The fix is included in the Perl 5.43.10 development release.

References ---------- https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch https://github.com/Perl/perl5/issues/23388

Last updated 27 August 2026

Last updated 27 August 2026

DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.

The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders.

DBI version 1.650 sets a hard limit of 99,999 placeholders.

String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service.

The trim and rtrim functions stripped trailing whitespace with s/\s$//u. Because \s matches greedily and the $ anchor fails whenever a non-whitespace character follows the whitespace, the regex engine retries the match at each offset of a long whitespace run, producing quadratic backtracking. The fix replaces \s$ with \s+$.

Any caller that passes untrusted input to trim or rtrim can trigger CPU exhaustion with a string containing a long run of whitespace.