Description
Storable versions before 3.05 for Perl has a stack overflow.
The retrieve_hook function stored the length of the class name into a signed integer but in read operations treated the length as unsigned. This allowed an attacker to craft data that could trigger the overflow.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| NWCLARK | Storable | < 3.05 | 3.05 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | perl | 5.28.0-3 | — |
| Debian 13 | perl | 5.28.0-3 | — |
| Debian 12 | perl | 5.28.0-3 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | perl | No fix yet | — |
| Ubuntu Pro 18.04 LTS | perl | No fix yet | — |
| Ubuntu Pro 16.04 LTS | perl | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | perl | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | perl-Storable +1 | 3.37-522.1.hum1 | RHSA-2026:7578 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | perl | 5.18.2-12.32.1 | SUSE-SU-2026:1567-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | perl-Storable | 2.45-3.amzn2.0.3 | ALAS2-2026-3388 |
Advisories 4
- RHSA-2026:7578 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 10, 2026
- WID-SEC-2026-1254 Red Hat Hardened Images RPMs (Storable for Perl): Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Jun 22, 2026
- ALAS2-2026-3388 Moderate: perl-Storable security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jun 22, 2026
- SUSE-SU-2026:1567-1 Security update for perl SUSE / openSUSE Security Updates · Apr 24, 2026
References
- https://github.com/Perl/perl5/issues/15831 issue-tracking
- https://github.com/Perl/perl5/commit/a258c17c6937f79529c8319a829310e09cdbd216.patch patch
- https://metacpan.org/release/RURBAN/Storable-3.05/changes release-notes
- https://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242533.html mailing-list
- https://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242703.html mailing-list