Last updated 26 June 2026
Last updated 27 August 2026
Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in Sregmatch
Last updated 27 August 2026
Perl threads have a working directory race condition where file operations may target unintended paths.
If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running.
This may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit.
The bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6
Last updated 19 August 2026
======================================================================== CVE-2026-19487 CPAN Security Group ========================================================================
CVE ID: CVE-2026-19487 Distribution: perl Versions: from 5.9.4 before 5.41.9
MetaCPAN: https://metacpan.org/dist/perl VCS Repo: https://github.com/Perl/perl5
Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in Sfindbyclass
Description ----------- Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in Sfindbyclass.
The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.
Example:
"ABCDE" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE "ABCDE" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed
An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.
Problem types ------------- - CWE-670 Always-Incorrect Control Flow Implementation
Solutions --------- Upgrade to Perl 5.42.0 or later, or apply the upstream patch.
References ---------- https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch https://github.com/Perl/perl5/issues/22892
End of life: 7/15/2029, Latest version: 5.44.0
======================================================================== CVE-2026-57432 CPAN Security Group ========================================================================
CVE ID: CVE-2026-57432 Distribution: perl Versions: through 5.43.10
MetaCPAN: https://metacpan.org/dist/perl VCS Repo: https://github.com/Perl/perl5
Perl versions through 5.43.10 have an integer overflow in Smeasurestruct leading to an out-of-bounds heap read in pack and unpack
Description ----------- Perl versions through 5.43.10 have an integer overflow in Smeasurestruct leading to an out-of-bounds heap read in pack and unpack.
Smeasurestruct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSizet total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.
A template derived from untrusted input can read heap memory past the buffer and return it to the caller.
Problem types ------------- - CWE-190 Integer Overflow or Wraparound - CWE-125 Out-of-bounds Read
Solutions --------- Apply the upstream patches. The fix is included in the Perl 5.43.11 development release.
References ---------- https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch
======================================================================== CVE-2026-13221 CPAN Security Group ========================================================================
CVE ID: CVE-2026-13221 Distribution: perl Versions: through 5.43.9
MetaCPAN: https://metacpan.org/dist/perl VCS Repo: https://github.com/Perl/perl5
Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perlstudychunk
Description ----------- Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perlstudychunk.
When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.
A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.
Problem types ------------- - CWE-190 Integer Overflow or Wraparound
Solutions --------- Apply the upstream patch. The fix is included in the Perl 5.43.10 development release.
References ---------- https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch https://github.com/Perl/perl5/issues/23388
Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count.
A flaw was found in Perl 5. A heap write overflow in regcomp.c file might be exploited when a perl program allows user input of patterns. A crafted regular expression can cause the heap buffer overflow, with control over the bytes written.
A flaw was found in Perl 5. A heap read overflow in regexec.c file may allow an attacker to cause a segmentation fault which might lead to a Denial of Service (DoS) or, possibly, heap memory disclosure.
Matching a crafted locale dependent regular expression can cause a heap buffer read overflow and potentially information disclosure while reporting an error message. That error message includes bytes beyond the end of the string, and possibly beyond the end of the buffer, providing a potential information disclosure if the memory had contained any sensitive information.
Last updated 25 August 2025
A vulnerability was found in perl. The regex engine got into an infinite loop because of the malformation. It is trying to back-up over a sequence of UTF-8 continuation bytes. The character just before the sequence should be a start byte. If it's not, there is a malformation which results in "hang" of regexp matching and CPU exhaustion.
External references:
https://rt.perl.org/Public/Bug/Display.html?id=123562
Upstream fix:
http://perl5.git.perl.org/perl.git/commitdiff/22b433eff9a1ffa2454e18405a56650f07b385b5
Perl 5.00404 and earlier follows symbolic links when running with the -e option, which allows local users to overwrite arbitrary files via a symlink attack on the /tmp/perl-eaXXXXX file.
The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of-bounds read) and possibly execute arbitrary code via a crafted (1) drive letter or (2) pInName argument.
Bruce Merry reported: [1] http://bugs.gentoo.org/showbug.cgi?id=313565
an integer overflow, leading to stack overflow in the way Perl regular expression engine processed certain regular expression(s). Remote attacker could use this flaw to cause a denial of service (crash of an application, using the Perl regular expression engine).
Public PoC from [1]: -------------------- perl -e 'if ((("a " x 100000) . "a\n") =~ /\A\S+(?: \S+)\n\z/) {}'
Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib.
Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-2026-3381 due to a vendored version of zlib which has several vulnerabilities, including CVE-2026-27171. The bundled Compress::Raw::Zlib was updated to version 2.221 in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94.
The Mojolicious module before 8.65 for Perl is vulnerable to securecompare timing attacks that allow an attacker to guess the length of a secret string. Only versions after 1.74 are affected.
A flaw was found in Perl versions 5.8.0 through 5.28. An Integer overflow leading to buffer overflow in Perlmysetenv function in util.c
Upstream Patch: https://github.com/Perl/perl5/commit/34716e2a6ee2af96078d62b065b7785c001194be
On 3/29/26 15:55, Stig Palmquist wrote: ======================================================================== CVE-2026-4176 CPAN Security Group ========================================================================
[...]
Solutions --------- Update to Perl stable release 5.40.4 or 5.42.2 or later, which include Compress::Raw::Zlib 2.222.
For any Perl version, simply install Compress::Raw::Zlib 2.222 from CPAN.
-- Jacob
======================================================================== CVE-2026-4176 CPAN Security Group ========================================================================
CVE ID: CVE-2026-4176 Distribution: perl Versions: from 5.9.4 before 5.40.4-RC1 from 5.41.0 before 5.42.2-RC1 from 5.43.0 before 5.43.9
MetaCPAN: https://metacpan.org/dist/perl VCS Repo: https://github.com/Perl/perl5
Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib
Description ----------- Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib.
Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-2026-3381 due to a vendored version of zlib which has several vulnerabilities, including CVE-2026-27171. The bundled Compress::Raw::Zlib was updated to version 2.221 in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94.
Problem types ------------- - CWE-1395 Dependency on Vulnerable Third-Party Component
Workarounds ----------- Install Compress::Raw::Zlib 2.220 or later into your @INC include path, so it takes precedence over the vulnerable core module shipped with Perl.
Some OS distributions patch their perl package to build Compress::Raw::Zlib against the system zlib rather than the vendored copy. Users of these distributions may not be affected if their system zlib has been updated to 1.3.2 or later, or includes backported patches for the relevant vulnerabilities.
Solutions --------- Update to Perl stable release 5.40.4 or 5.42.2 or later, which include Compress::Raw::Zlib 2.222.
References ---------- https://www.cve.org/CVERecord?id=CVE-2026-3381 https://lists.security.metacpan.org/cve-announce/msg/37638919/ https://github.com/Perl/perl5/commit/c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94 https://metacpan.org/release/PMQS/Compress-Raw-Zlib-2.221/source/Changes https://metacpan.org/release/SHAY/perl-5.40.4/changes https://metacpan.org/release/SHAY/perl-5.42.2/changes
Timeline -------- - 2026-02-27: Compress::Raw::Zlib 2.221 committed to Perl blead. - 2026-03-07: CVE-2026-3381 published for Compress::Raw::Zlib. - 2026-03-14: CVE-2026-4176 reserved. - 2026-03-29: Perl 5.40.4 and 5.42.2 released.
Credits ------- Bernhard Schmalhofer, reporter
YAML::Syck versions before 1.36 for Perl has missing null-terminators which causes out-of-bounds read and potential information disclosure
Missing null terminators in token.c leads to but-of-bounds read which allows adjacent variable to be read
The issue is seen with complex YAML files with a hash of all keys and empty values. There is no indication that the issue leads to accessing memory outside that allocated to the module.
A heap buffer overflow vulnerability was discovered in Perl.
Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10.
When there are non-ASCII bytes in the left-hand-side of the tr operator, Sdotransinvmap can overflow the destination pointer d.
$ perl -e '$ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;' Segmentation fault (core dumped)
It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses.
Accounts. A logic issue was addressed with improved file handling.
Accounts. A logic issue was addressed with improved file handling.
Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.
Perl before 5.30.3 has an integer overflow related to mishandling of a "PLregkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.
Perl. This issue was addressed with improved checks.