Summary
It was discovered that Perl incorrectly handled short source addresses
in the Socket module. An attacker could possibly use this issue to
trigger an out-of-bounds heap read, resulting in information disclosure.
(CVE-2026-12087)
It was discovered that Perl incorrectly handled regular expressions
containing a large number of fixed string alternatives. An attacker
could possibly use this issue to cause incorrect regular expression
matches, resulting in security restrictions being bypassed.
(CVE-2026-13221)
It was discovered that Perl incorrectly handled certain large repeat
counts when processing pack and unpack templates. An attacker could
possibly use this issue to trigger an out-of-bounds heap read, resulting
in information disclosure. (CVE-2026-57432)
It was discovered that Perl incorrectly handled certain crafted data
when deserializing with the Storable module. An attacker could possibly
use this issue to trigger an integer overflow and application
termination, resulting in a denial of service. (CVE-2026-57433)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | perl | 5.34.0-3ubuntu1.8 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | perl | 5.18.2-2ubuntu1.7+esm8 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | perl | 5.22.1-9ubuntu0.9+esm3 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | perl | 5.26.1-6ubuntu0.7+esm3 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | perl | 5.30.0-9ubuntu0.5+esm3 |
Vulnerabilities 4
-
Critical 9.8
Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record
Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wr…
-
Critical 9.1CVE-2026-12087 Public exploit
Socket versions before 2.041 for Perl have an out-of-bounds heap read
Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argum…
-
Critical 9.1
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When suc…
-
High 8.4
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to …