A heap buffer overflow vulnerability was discovered in Perl.
Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10.
When there are non-ASCII bytes in the left-hand-side of the tr operator, Sdotransinvmap can overflow the destination pointer d.
$ perl -e '$ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;' Segmentation fault (core dumped)
It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses.
YAML::Syck versions before 1.36 for Perl has missing Null-Terminators which causes Out-of-Bounds Read and potential Information Disclosure
Last updated 9 September 2026
Last updated 9 September 2026
Last updated 16 September 2026
In Perl 5.34.0, function Sfinduninitvar in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation.
Perl. This issue was addressed with improved checks.
Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.
Perl before 5.30.3 has an integer overflow related to mishandling of a "PLregkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.
A crafted regular expression when compiled by perl 5.30.0 through 5.38.0 can cause a one attacker controlled byte buffer overflow in a heap allocated buffer.
Last updated 16 September 2026
Last updated 26 June 2026
Perl threads have a working directory race condition where file operations may target unintended paths.
If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running.
This may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit.
The bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6
======================================================================== CVE-2026-19487 CPAN Security Group ========================================================================
CVE ID: CVE-2026-19487 Distribution: perl Versions: from 5.9.4 before 5.41.9
MetaCPAN: https://metacpan.org/dist/perl VCS Repo: https://github.com/Perl/perl5
Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in Sfindbyclass
Description ----------- Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in Sfindbyclass.
The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.
Example:
"ABCDE" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE "ABCDE" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed
An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.
Problem types ------------- - CWE-670 Always-Incorrect Control Flow Implementation
Solutions --------- Upgrade to Perl 5.42.0 or later, or apply the upstream patch.
References ---------- https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch https://github.com/Perl/perl5/issues/22892
End of life: 7/15/2029, Latest version: 5.44.0
======================================================================== CVE-2026-57432 CPAN Security Group ========================================================================
CVE ID: CVE-2026-57432 Distribution: perl Versions: through 5.43.10
MetaCPAN: https://metacpan.org/dist/perl VCS Repo: https://github.com/Perl/perl5
Perl versions through 5.43.10 have an integer overflow in Smeasurestruct leading to an out-of-bounds heap read in pack and unpack
Description ----------- Perl versions through 5.43.10 have an integer overflow in Smeasurestruct leading to an out-of-bounds heap read in pack and unpack.
Smeasurestruct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSizet total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.
A template derived from untrusted input can read heap memory past the buffer and return it to the caller.
Problem types ------------- - CWE-190 Integer Overflow or Wraparound - CWE-125 Out-of-bounds Read
Solutions --------- Apply the upstream patches. The fix is included in the Perl 5.43.11 development release.
References ---------- https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch
======================================================================== CVE-2026-13221 CPAN Security Group ========================================================================
CVE ID: CVE-2026-13221 Distribution: perl Versions: through 5.43.9
MetaCPAN: https://metacpan.org/dist/perl VCS Repo: https://github.com/Perl/perl5
Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perlstudychunk
Description ----------- Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perlstudychunk.
When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.
A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.
Problem types ------------- - CWE-190 Integer Overflow or Wraparound
Solutions --------- Apply the upstream patch. The fix is included in the Perl 5.43.10 development release.
References ---------- https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch https://github.com/Perl/perl5/issues/23388
Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib.
Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-2026-3381 due to a vendored version of zlib which has several vulnerabilities, including CVE-2026-27171. The bundled Compress::Raw::Zlib was updated to version 2.221 in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94.
The Mojolicious module before 8.65 for Perl is vulnerable to securecompare timing attacks that allow an attacker to guess the length of a secret string. Only versions after 1.74 are affected.
Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count.
A flaw was found in Perl 5. A heap write overflow in regcomp.c file might be exploited when a perl program allows user input of patterns. A crafted regular expression can cause the heap buffer overflow, with control over the bytes written.
A flaw was found in Perl 5. A heap read overflow in regexec.c file may allow an attacker to cause a segmentation fault which might lead to a Denial of Service (DoS) or, possibly, heap memory disclosure.
Matching a crafted locale dependent regular expression can cause a heap buffer read overflow and potentially information disclosure while reporting an error message. That error message includes bytes beyond the end of the string, and possibly beyond the end of the buffer, providing a potential information disclosure if the memory had contained any sensitive information.
Last updated 25 August 2025
A vulnerability was found in perl. The regex engine got into an infinite loop because of the malformation. It is trying to back-up over a sequence of UTF-8 continuation bytes. The character just before the sequence should be a start byte. If it's not, there is a malformation which results in "hang" of regexp matching and CPU exhaustion.
External references:
https://rt.perl.org/Public/Bug/Display.html?id=123562
Upstream fix:
http://perl5.git.perl.org/perl.git/commitdiff/22b433eff9a1ffa2454e18405a56650f07b385b5
Perl 5.00404 and earlier follows symbolic links when running with the -e option, which allows local users to overwrite arbitrary files via a symlink attack on the /tmp/perl-eaXXXXX file.
The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of-bounds read) and possibly execute arbitrary code via a crafted (1) drive letter or (2) pInName argument.
Bruce Merry reported: [1] http://bugs.gentoo.org/showbug.cgi?id=313565
an integer overflow, leading to stack overflow in the way Perl regular expression engine processed certain regular expression(s). Remote attacker could use this flaw to cause a denial of service (crash of an application, using the Perl regular expression engine).
Public PoC from [1]: -------------------- perl -e 'if ((("a " x 100000) . "a\n") =~ /\A\S+(?: \S+)\n\z/) {}'
A flaw was found in Perl versions 5.8.0 through 5.28. An Integer overflow leading to buffer overflow in Perlmysetenv function in util.c
Upstream Patch: https://github.com/Perl/perl5/commit/34716e2a6ee2af96078d62b065b7785c001194be
On 3/29/26 15:55, Stig Palmquist wrote: ======================================================================== CVE-2026-4176 CPAN Security Group ========================================================================
[...]
Solutions --------- Update to Perl stable release 5.40.4 or 5.42.2 or later, which include Compress::Raw::Zlib 2.222.
For any Perl version, simply install Compress::Raw::Zlib 2.222 from CPAN.
-- Jacob
======================================================================== CVE-2026-4176 CPAN Security Group ========================================================================
CVE ID: CVE-2026-4176 Distribution: perl Versions: from 5.9.4 before 5.40.4-RC1 from 5.41.0 before 5.42.2-RC1 from 5.43.0 before 5.43.9
MetaCPAN: https://metacpan.org/dist/perl VCS Repo: https://github.com/Perl/perl5
Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib
Description ----------- Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib.
Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-2026-3381 due to a vendored version of zlib which has several vulnerabilities, including CVE-2026-27171. The bundled Compress::Raw::Zlib was updated to version 2.221 in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94.
Problem types ------------- - CWE-1395 Dependency on Vulnerable Third-Party Component
Workarounds ----------- Install Compress::Raw::Zlib 2.220 or later into your @INC include path, so it takes precedence over the vulnerable core module shipped with Perl.
Some OS distributions patch their perl package to build Compress::Raw::Zlib against the system zlib rather than the vendored copy. Users of these distributions may not be affected if their system zlib has been updated to 1.3.2 or later, or includes backported patches for the relevant vulnerabilities.
Solutions --------- Update to Perl stable release 5.40.4 or 5.42.2 or later, which include Compress::Raw::Zlib 2.222.
References ---------- https://www.cve.org/CVERecord?id=CVE-2026-3381 https://lists.security.metacpan.org/cve-announce/msg/37638919/ https://github.com/Perl/perl5/commit/c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94 https://metacpan.org/release/PMQS/Compress-Raw-Zlib-2.221/source/Changes https://metacpan.org/release/SHAY/perl-5.40.4/changes https://metacpan.org/release/SHAY/perl-5.42.2/changes
Timeline -------- - 2026-02-27: Compress::Raw::Zlib 2.221 committed to Perl blead. - 2026-03-07: CVE-2026-3381 published for Compress::Raw::Zlib. - 2026-03-14: CVE-2026-4176 reserved. - 2026-03-29: Perl 5.40.4 and 5.42.2 released.
Credits ------- Bernhard Schmalhofer, reporter