Description
The rehash mechanism in Perl 5.8.2 through 5.16.x allows context-dependent attackers to cause a denial of service (memory consumption and crash) via a crafted hash key.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | perl | 5.14.2-19 | — |
| Debian 13 | perl | 5.14.2-19 | — |
| Debian 12 | perl | 5.14.2-19 | — |
| Debian 6.0 | perl | 5.10.1-17squeeze6 | DSA-2641-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | perl +3 | 4:5.10.1-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Archive-Extract | 1:0.38-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Archive-Tar | 1.58-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-CGI | 3.51-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-CPAN | 1.9402-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-CPANPLUS | 0.88-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Compress-Raw-Zlib | 1:2.020-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Compress-Zlib +4 | 2.020-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Digest-SHA | 1:5.47-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-ExtUtils-CBuilder | 1:0.27-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-ExtUtils-Embed | 1.28-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-ExtUtils-MakeMaker | 6.55-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-ExtUtils-ParseXS | 1:2.2003.0-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-File-Fetch | 0.26-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-IO-Zlib | 1:1.09-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-IPC-Cmd | 1:0.56-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Locale-Maketext-Simple | 1:0.18-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Log-Message +2 | 1:0.02-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Log-Message-Simple | 0.04-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Module-Build | 1:0.3500-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Module-CoreList | 2.18-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Module-Load | 1:0.16-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Module-Load-Conditional | 0.30-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Module-Pluggable | 1:3.90-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Object-Accessor | 1:0.34-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Params-Check | 1:0.26-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Parse-CPAN-Meta | 1:1.40-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Pod-Escapes | 1:1.04-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Pod-Simple | 1:3.13-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Term-UI | 0.20-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Test-Harness | 3.17-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Test-Simple | 0.92-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Time-HiRes | 4:1.9721-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Time-Piece | 1.15-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-core | 5.10.1-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-parent | 1:0.221-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-version | 3:0.77-130.el6_4 | RHSA-2013:0685 |
| RHEL 5 | perl +1 | 4:5.8.8-40.el5_9 | RHSA-2013:0685 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache2-mod_perl | 2.0.9-5.1 | openSUSE-SU-2024:10161-1 |
Advisories 3
- RHSA-2013:0685 Red Hat Security Advisory: perl security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- DSA-2641-1 perl - rehashing flaw Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10161-1 apache2-mod_perl-2.0.9-5.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- [perl.perl5.porters] 20130304 CVE-2013-1667: important rehashing flaw mailing-list
- 52472 third-party-advisory
- MDVSA-2013:113 vendor-advisory
- https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0094
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702296
- 52499 third-party-advisory
- APPLE-SA-2013-10-22-3 vendor-advisory
- http://perl5.git.perl.org/perl.git/commitdiff/d59e31f
- 58311 vdb-entry
- 90892 vdb-entry
- perl-rehash-dos(82598) vdb-entry
- SSRT101274 vendor-advisory
- oval:org.mitre.oval:def:18771 vdb-entry signature
- http://perl5.git.perl.org/perl.git/commitdiff/9d83adc
- DSA-2641 vendor-advisory
- http://perl5.git.perl.org/perl.git/commitdiff/6e79fe5
- USN-1770-1 vendor-advisory
- RHSA-2013:0685 vendor-advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- https://bugzilla.redhat.com/show_bug.cgi?id=912276
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735