======================================================================== CVE-2026-19487 CPAN Security Group ========================================================================
CVE ID: CVE-2026-19487 Distribution: perl Versions: from 5.9.4 before 5.41.9
MetaCPAN: https://metacpan.org/dist/perl VCS Repo: https://github.com/Perl/perl5
Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in Sfindbyclass
Description ----------- Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in Sfindbyclass.
The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.
Example:
"ABCDE" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE "ABCDE" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed
An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.
Problem types ------------- - CWE-670 Always-Incorrect Control Flow Implementation
Solutions --------- Upgrade to Perl 5.42.0 or later, or apply the upstream patch.
References ---------- https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch https://github.com/Perl/perl5/issues/22892
Last updated 19 August 2026
Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in Sregmatch
End of life: 7/15/2029, Latest version: 5.44.0
======================================================================== CVE-2026-57432 CPAN Security Group ========================================================================
CVE ID: CVE-2026-57432 Distribution: perl Versions: through 5.43.10
MetaCPAN: https://metacpan.org/dist/perl VCS Repo: https://github.com/Perl/perl5
Perl versions through 5.43.10 have an integer overflow in Smeasurestruct leading to an out-of-bounds heap read in pack and unpack
Description ----------- Perl versions through 5.43.10 have an integer overflow in Smeasurestruct leading to an out-of-bounds heap read in pack and unpack.
Smeasurestruct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSizet total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.
A template derived from untrusted input can read heap memory past the buffer and return it to the caller.
Problem types ------------- - CWE-190 Integer Overflow or Wraparound - CWE-125 Out-of-bounds Read
Solutions --------- Apply the upstream patches. The fix is included in the Perl 5.43.11 development release.
References ---------- https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch
======================================================================== CVE-2026-13221 CPAN Security Group ========================================================================
CVE ID: CVE-2026-13221 Distribution: perl Versions: through 5.43.9
MetaCPAN: https://metacpan.org/dist/perl VCS Repo: https://github.com/Perl/perl5
Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perlstudychunk
Description ----------- Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perlstudychunk.
When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.
A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.
Problem types ------------- - CWE-190 Integer Overflow or Wraparound
Solutions --------- Apply the upstream patch. The fix is included in the Perl 5.43.10 development release.
References ---------- https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch https://github.com/Perl/perl5/issues/23388
Last updated 27 August 2026
Last updated 27 August 2026
Last updated 26 June 2026
On 3/29/26 15:55, Stig Palmquist wrote: ======================================================================== CVE-2026-4176 CPAN Security Group ========================================================================
[...]
Solutions --------- Update to Perl stable release 5.40.4 or 5.42.2 or later, which include Compress::Raw::Zlib 2.222.
For any Perl version, simply install Compress::Raw::Zlib 2.222 from CPAN.
-- Jacob
======================================================================== CVE-2026-4176 CPAN Security Group ========================================================================
CVE ID: CVE-2026-4176 Distribution: perl Versions: from 5.9.4 before 5.40.4-RC1 from 5.41.0 before 5.42.2-RC1 from 5.43.0 before 5.43.9
MetaCPAN: https://metacpan.org/dist/perl VCS Repo: https://github.com/Perl/perl5
Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib
Description ----------- Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib.
Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-2026-3381 due to a vendored version of zlib which has several vulnerabilities, including CVE-2026-27171. The bundled Compress::Raw::Zlib was updated to version 2.221 in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94.
Problem types ------------- - CWE-1395 Dependency on Vulnerable Third-Party Component
Workarounds ----------- Install Compress::Raw::Zlib 2.220 or later into your @INC include path, so it takes precedence over the vulnerable core module shipped with Perl.
Some OS distributions patch their perl package to build Compress::Raw::Zlib against the system zlib rather than the vendored copy. Users of these distributions may not be affected if their system zlib has been updated to 1.3.2 or later, or includes backported patches for the relevant vulnerabilities.
Solutions --------- Update to Perl stable release 5.40.4 or 5.42.2 or later, which include Compress::Raw::Zlib 2.222.
References ---------- https://www.cve.org/CVERecord?id=CVE-2026-3381 https://lists.security.metacpan.org/cve-announce/msg/37638919/ https://github.com/Perl/perl5/commit/c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94 https://metacpan.org/release/PMQS/Compress-Raw-Zlib-2.221/source/Changes https://metacpan.org/release/SHAY/perl-5.40.4/changes https://metacpan.org/release/SHAY/perl-5.42.2/changes
Timeline -------- - 2026-02-27: Compress::Raw::Zlib 2.221 committed to Perl blead. - 2026-03-07: CVE-2026-3381 published for Compress::Raw::Zlib. - 2026-03-14: CVE-2026-4176 reserved. - 2026-03-29: Perl 5.40.4 and 5.42.2 released.
Credits ------- Bernhard Schmalhofer, reporter
Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib.
Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-2026-3381 due to a vendored version of zlib which has several vulnerabilities, including CVE-2026-27171. The bundled Compress::Raw::Zlib was updated to version 2.221 in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94.
YAML::Syck versions before 1.36 for Perl has missing null-terminators which causes out-of-bounds read and potential information disclosure
Missing null terminators in token.c leads to but-of-bounds read which allows adjacent variable to be read
The issue is seen with complex YAML files with a hash of all keys and empty values. There is no indication that the issue leads to accessing memory outside that allocated to the module.
End of life: 7/3/2028, Latest version: 5.42.3
Perl threads have a working directory race condition where file operations may target unintended paths.
If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running.
This may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit.
The bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6
A heap buffer overflow vulnerability was discovered in Perl.
Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10.
When there are non-ASCII bytes in the left-hand-side of the tr operator, Sdotransinvmap can overflow the destination pointer d.
$ perl -e '$ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;' Â Â Segmentation fault (core dumped)
It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses.
End of life: 6/9/2027, End of support: 7/15/2026, Latest version: 5.40.5
End of life: 6/9/2027, End of support: 7/15/2026, Latest version: 5.40.5
The Mojolicious module before 8.65 for Perl is vulnerable to securecompare timing attacks that allow an attacker to guess the length of a secret string. Only versions after 1.74 are affected.
A crafted regular expression when compiled by perl 5.30.0 through 5.38.0 can cause a one attacker controlled byte buffer overflow in a heap allocated buffer.
Accounts. A logic issue was addressed with improved file handling.
Accounts. A logic issue was addressed with improved file handling.
Perl. This issue was addressed with improved checks.
Perl before 5.30.3 has an integer overflow related to mishandling of a "PLregkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.
Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.
A flaw was found in Perl versions 5.18 through 5.28. A Heap-based buffer overflow
Upstream Patch: https://github.com/Perl/perl5/commit/19a498a461d7c81ae3507c450953d1148efecf4f
A flaw was found in Perl versions 5.22 through 5.26. Heap-buffer-overflow read in regcomp.c
Upstream Patch: https://github.com/Perl/perl5/commit/43b2f4ef399e2fd7240b4eeb0658686ad95f8e62
A flaw was found in Perl versions 5.18 through 5.26. A Heap-buffer-overflow write / regnode overrun
A flaw was found in Perl versions 5.8.0 through 5.28. An Integer overflow leading to buffer overflow in Perlmysetenv function in util.c
Upstream Patch: https://github.com/Perl/perl5/commit/34716e2a6ee2af96078d62b065b7785c001194be
In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name.