CVE-2026-13221
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. Overflow of a 16-bit field truncates the match decision table, leading to false positive and false negative matches.
Risk Assessment
If such a pattern gates access or filtering decisions, incorrect matches could lead to unauthorized access or blocking of legitimate operations.
Recommendation
Upgrade Perl to version 5.40.5-RC1, 5.42.3-RC1, or 5.43.10 (or later) depending on the branch in use.
Other vulnerabilities in Perl
See all- CVE-2016-1238High
Perl versions 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 improperly remove '.' characters from the end of the includes directory array. This may allow local users to gain privileges via a Trojan horse module under the current working directory.
- CVE-2016-2381High
Perl may allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.
- CVE-2023-47038High
A vulnerability in Perl 5.30.0 through 5.38.0 allows a heap buffer overflow when compiling a crafted regular expression. An attacker can exploit this to cause a controlled buffer overflow.
- CVE-2024-56406High
A heap buffer overflow vulnerability was discovered in Perl. Affected versions include release branches 5.34, 5.36, 5.38, and 5.40, as well as development versions from 5.33.1 through 5.41.10. When non-ASCII bytes are present in the left-hand side of the `tr` operator, `S_do_trans_invmap` can overflow the buffer.
- CVE-2026-8376Critical
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. The bug in Perl_study_chunk in regcomp_study.c checked buffer size in characters rather than bytes, leading to undersized allocation and out-of-bounds write.
- CVE-2022-48522Critical
In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation.
- CVE-2020-12723High
In Perl before 5.30.3, regcomp.c allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.
- CVE-2020-10878High
Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.
- CVE-2020-10543High
In Perl before 5.30.3 on 32-bit platforms, a heap-based buffer overflow occurs because nested regular expression quantifiers have an integer overflow.
- CVE-2015-8608Critical
The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of-bounds read) and possibly execute arbitrary code via a crafted (1) drive letter or (2) pInName argument.
Original NVD description (English source)
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS