Improper neutralization of user data in the DjVu file format in Exiftool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

A heap buffer overflow vulnerability was discovered in Perl.

Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10.

When there are non-ASCII bytes in the left-hand-side of the tr operator, Sdotransinvmap can overflow the destination pointer d.

$ perl -e '$ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;'    Segmentation fault (core dumped)

It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses.

String::Compare::ConstantTime for Perl through 0.321 is vulnerable to timing attacks that allow an attacker to guess the length of a secret string.

As stated in the documentation: "If the lengths of the strings are different, because equals returns false right away the size of the secret string may be leaked (but not its contents)."

This is similar to CVE-2020-36829

Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width

[Unknown description]

[Unknown description]

[Unknown description]

[Unknown description]

[Unknown description]

DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders

YAML::Syck versions before 1.36 for Perl has missing Null-Terminators which causes Out-of-Bounds Read and potential Information Disclosure

YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key in syckhdlraddanchor

Last updated 9 September 2026

Last updated 9 September 2026

DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row

DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location

DBI::ProfileData versions before 1.651 for Perl do not limit the path index

HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes.

The parsercparse function never advances the attribute-parse state cursor on certain malformed attribute forms, looping forever.

Nameless attributes such as "<a ='c'>" or unbalanced quotes "<a b='''''''c'>" can trigger this condition.

Note that the latest version available on CPAN is version 0.02. Newer versions are available on the git repository.

HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead.

The parsercparse function attempts to check for multicharacter strings such as "<![CDATA" or element terminators such as ">" without checking that the offsets are within the buffer.

Truncated strings such as "<a/" can trigger an out-of-bounds read.

Note that the latest version available on CPAN is version 0.02. Newer versions are available on the git repository.

Dancer::Plugin::Auth::Google versions before 0.08 for Perl have TLS verification disabled.

The default user agent is initialised with SSLverifymode explicitly disabled.

An attacker with network man-in-the-middle (MITM) capability between the Dancer application and googleapis.com can intercept the OAuth2 token exchange and userinfo fetch, return a forged accesstoken and user profile, and be logged in to the Dancer application as any Google user.

HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parsedate.

Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR.

Net::DNS::RR::OPT::EXTENDEDERROR::decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:"<command>"} in EXTRA-TEXT.

Data::Intern::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated slot, reverse and arena indices in siidxfind.

The attach-time validator sivalidateheader is thorough about the header and layout (magic, version, section offsets, totalsize, count and arenaused) but does not validate the three arrays it then trusts. Every lookup in siidxfind walks a triple indirection read straight from the mmap'd segment, arena[reverse[slots[i].id]], with no bound on slots[i].id against count, on the reverse[id] arena offset against arenaused, or on the arena record's length prefix.

A local peer that can write the backing file can leave the header valid while poisoning a slot id, a reverse offset or an arena length prefix, so an idof, intern or string lookup dereferences the chain out of bounds; because string() returns a file-controlled length of bytes from the arena, adjacent process memory can be disclosed.

Data::RingBuffer::Shared versions before 0.04 for Perl allow a stack buffer overflow via an unvalidated elemsize in ringreadseq.

The attach-time validator ringvalidateheader checks the capacity-overflow and totalsize consistency of the header but never caps elemsize against the destination size. ringreadseq does memcpy(out, ringslot(h, seq), elemsize) with elemsize read raw from the mmap'd segment, copying into a fixed 8-byte destination scalar. An elemsize larger than 8 bytes writes past the destination.

A local peer that can write the backing file can leave the header valid while setting a large elemsize, so the next read copies a file-controlled length into the fixed 8-byte stack buffer, corrupting adjacent stack frames.

Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check.

The parse regexes capture year, month and day with the \d shorthand, which on a character string matches the whole Unicode decimal digit property \p{Nd} and not just [0-9]. Date::Manip::Base::check then validates the captured fields with numeric comparisons alone ($y<1 || $y>9999, $m<1 || $m>12, $d<1 || $d>$days), and parsecheck stores the numified fields ($y+0). Perl truncates a string at the first character that is not an ASCII digit, so a field whose leading characters are ASCII digits numifies to an in-range prefix and satisfies every test: a year field of three ASCII digits followed by U+0664 ARABIC-INDIC DIGIT FOUR numifies to 202, giving the year 0202, and one non-ASCII digit in the month or day field shifts those fields the same way. The hour, minute and second fields match explicit ASCII character classes (0?[0-9], [0-5][0-9]) and do not shift, though a non-ASCII digit in a fractional hour or minute field truncates the fraction.

Any caller that passes an untrusted character string to ParseDate() or Date::Manip::Date->parse() can get back a date that differs from the string it parsed, with no parse error. Where the parsed date gates logic such as an expiry check or a retention window, the shift goes unnoticed.

Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in printattribute via a zero length BMPSTRING attribute.

printattribute() sizes the destination buffer for a BMPSTRING attribute from its declared byte length with Renew(attribute, length, char). A zero length attribute makes that a zero size reallocation, which Perl implements as a free returning NULL, so the buffer pointer becomes NULL, the following strncpy copies nothing, and the caller dereferences NULL in the strlen() it passes to newSVpvn(). A zero length BMPSTRING is even length, so the ASN.1 decoder accepts it and the value reaches this code. The UTF8STRING, OCTET STRING and BIT STRING arms size on length + 1 or length 4 + 1 and are unaffected.

Any caller that passes an untrusted PKCS#12 file to infoashash() can crash the process. info() prints attribute values directly without sizing a buffer and is unaffected.

Last updated 16 September 2026

In Perl 5.34.0, function Sfinduninitvar in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation.

Perl. This issue was addressed with improved checks.

Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.