Skip to content
OpenAdvisories
Critical USN-8684-1 9 CVEs

perl vulnerabilities

Published Aug 27, 2026 · Updated Aug 31, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Perl incorrectly handled certain arguments to
Socket and pack/unpack functions. An attacker could possibly use this
issue to read sensitive information from memory.
(CVE-2026-12087, CVE-2026-57432)

It was discovered that Perl incorrectly handled regular expressions
with a large number of alternation branches. An attacker could
possibly use this issue to cause incorrect matching results.
(CVE-2026-13221)

It was discovered that Perl incorrectly handled certain files. An
attacker could possibly use this issue to cause a denial of service.
(CVE-2026-57433, CVE-2025-15649, CVE-2026-48959, CVE-2026-9538)

It was discovered that Perl incorrectly handled certain inputs. An
attacker could possibly use this issue to execute arbitrary code.
(CVE-2026-48962)

It was discovered that Perl incorrectly handled credential headers
during cross-origin redirects in HTTP::Tiny. An attacker could
possibly use this issue to expose sensitive information.
(CVE-2026-7017)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 24.04 LTS 24.04:LTS perl 5.38.2-3.2ubuntu0.4

Vulnerabilities 9

  • Critical 9.8
    CVE-2026-57433

    Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record

    Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wr…

    HAARG Storable perl perl Debian Ubuntu Azure Linux Alpine
  • Critical 9.1
    CVE-2026-12087 Public exploit

    Socket versions before 2.041 for Perl have an out-of-bounds heap read

    Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argum…

    PEVANS Socket perl perl Debian Ubuntu Azure Linux Alpine
  • Critical 9.1
    CVE-2026-13221

    Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk

    Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When suc…

    perl perl perl perl Debian Ubuntu Azure Linux Alpine Wolfi
  • High 8.4
    CVE-2026-57432

    Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack

    Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to …

    perl perl perl perl Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2026-48959

    IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward

    IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward. fastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks …

    PMQS IO::Uncompress::Unzip perl perl Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2026-9538

    Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header

    Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header. _read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field i…

    BINGOS Archive::Tar perl perl Debian Ubuntu Alpine
  • High 7.3
    CVE-2026-48962 Public exploit

    IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob

    IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() …

    PMQS IO::Compress perl perl Debian Ubuntu Azure Linux Alpine
  • High 7.1
    CVE-2026-7017

    HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets

    HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argu…

    HAARG HTTP::Tiny perl perl Debian Ubuntu Azure Linux Alpine
  • Medium 5.5
    CVE-2025-15649

    IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date

    IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date. _dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval g…

    PMQS IO::Uncompress::Unzip perl perl Debian Ubuntu Azure Linux Alpine

References

  • report
    https://ubuntu.com/security/CVE-2025-15649
  • report
    https://ubuntu.com/security/CVE-2026-7017
  • report
    https://ubuntu.com/security/CVE-2026-9538
  • report
    https://ubuntu.com/security/CVE-2026-12087
  • report
    https://ubuntu.com/security/CVE-2026-13221
  • report
    https://ubuntu.com/security/CVE-2026-48959
  • report
    https://ubuntu.com/security/CVE-2026-48962
  • report
    https://ubuntu.com/security/CVE-2026-57432
  • report
    https://ubuntu.com/security/CVE-2026-57433