Skip to content
OpenAdvisories
Medium RHSA-2025:11805 1 CVE

Red Hat Security Advisory: perl security update

Published Jul 28, 2025 · Updated Sep 2, 2026

Ecosystem: Red Hat

Fixed packages 41

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream perl 4:5.26.3-423.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream perl-Attribute-Handlers 0:0.99-423.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream perl-debuginfo 4:5.26.3-423.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream perl-debugsource 4:5.26.3-423.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream perl-devel 4:5.26.3-423.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream perl-Devel-Peek 0:1.26-423.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream perl-Devel-Peek-debuginfo 0:1.26-423.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream perl-Devel-SelfStubber 0:1.06-423.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream perl-ExtUtils-Embed 0:1.34-423.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream perl-ExtUtils-Miniperl 0:1.06-423.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream perl-interpreter-debuginfo 4:5.26.3-423.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream perl-IO-debuginfo 0:1.38-423.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream perl-libnetcfg 4:5.26.3-423.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream perl-libs-debuginfo 4:5.26.3-423.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream perl-Locale-Maketext-Simple 1:0.21-423.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream perl-Memoize 0:1.03-423.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream perl-Module-Loaded 1:0.08-423.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream perl-Net-Ping 0:2.55-423.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream perl-open 0:1.11-423.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream perl-Pod-Html 0:1.22.02-423.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream perl-SelfLoader 0:1.23-423.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream perl-Test 0:1.30-423.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream perl-tests 4:5.26.3-423.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream perl-Time-Piece 0:1.31-423.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream perl-Time-Piece-debuginfo 0:1.31-423.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream perl-utils 0:5.26.3-423.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos perl 4:5.26.3-423.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos perl-debuginfo 4:5.26.3-423.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos perl-debugsource 4:5.26.3-423.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos perl-Devel-Peek-debuginfo 0:1.26-423.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos perl-Errno 0:1.28-423.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos perl-interpreter 4:5.26.3-423.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos perl-interpreter-debuginfo 4:5.26.3-423.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos perl-IO 0:1.38-423.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos perl-IO-debuginfo 0:1.38-423.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos perl-IO-Zlib 1:1.10-423.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos perl-libs 4:5.26.3-423.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos perl-libs-debuginfo 4:5.26.3-423.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos perl-macros 4:5.26.3-423.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos perl-Math-Complex 0:1.59-423.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos perl-Time-Piece-debuginfo 0:1.31-423.el8_10

Vulnerabilities 1

  • Medium 5.9
    CVE-2025-40909

    Perl threads have a working directory race condition where file operations may target unintended paths

    Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the n…

    perl perl perl perl Debian Ubuntu Azure Linux Wolfi

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2369407
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_11805.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-40909
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-40909
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-40909
  • article
    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1098226
  • article
    https://github.com/Perl/perl5/commit/11a11ecf4bea72b17d250cfb43c897be1341861e
  • article
    https://github.com/Perl/perl5/commit/918bfff86ca8d6d4e4ec5b30994451e0bd74aba9.patch
  • article
    https://github.com/Perl/perl5/issues/10387
  • article
    https://github.com/Perl/perl5/issues/23010
  • article
    https://perldoc.perl.org/5.14.0/perl5136delta#Directory-handles-not-copied-to-threads
  • article
    https://www.openwall.com/lists/oss-security/2025/05/22/2