Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.
Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer.
A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade perl-testsUpgrade perl-develUpgrade perl-ExtUtils-InstallUpgrade perl-libsUpgrade perlUpgrade perl-IO-ZlibUpgrade perl-Pod-EscapesUpgrade perl-Package-ConstantsUpgrade perl-coreUpgrade perl-CPANUpgrade perl-ExtUtils-CBuilderUpgrade perl-Locale-Maketext-SimpleUpgrade perl-Module-LoadedUpgrade perl-debuginfoUpgrade perl-Time-PieceUpgrade perl-ExtUtils-EmbedUpgrade perl-macrosUpgrade perl-Object-AccessorUpgrade perl-Module-CoreList | Jun 9, 2026 | Jun 9, 2026 |
| Amazon_linux_2023 | — | Upgrade perl-Attribute-HandlersUpgrade perl-SelfLoaderUpgrade perl-SelectSaverUpgrade perl-libsUpgrade perl-Module-LoadedUpgrade perl-AutoSplitUpgrade perl-DBM_FilterUpgrade perl-Search-DictUpgrade perl-File-DosGlob-debuginfoUpgrade perl-blibUpgrade perl-Devel-PeekUpgrade perl-DynaLoaderUpgrade perl-FcntlUpgrade perl-NEXTUpgrade perl-File-FindUpgrade perl-I18N-LangTagsUpgrade perl-debuggerUpgrade perl-TestUpgrade perl-Config-ExtensionsUpgrade perl-interpreterUpgrade perl-OpcodeUpgrade perl-Opcode-debuginfoUpgrade perl-Pod-FunctionsUpgrade perl-sigtrapUpgrade perl-BenchmarkUpgrade perl-Sys-Hostname-debuginfoUpgrade perl-testsUpgrade perl-NDBM_FileUpgrade perl-NDBM_File-debuginfoUpgrade perl-phUpgrade perl-Class-StructUpgrade perl-POSIX-debuginfoUpgrade perl-Term-ReadLineUpgrade perl-File-DosGlobUpgrade perl-Unicode-UCDUpgrade perl-AutoLoaderUpgrade perl-ExtUtils-MiniperlUpgrade perl-libs-debuginfoUpgrade perl-Hash-Util-FieldHashUpgrade perl-mro-debuginfoUpgrade perl-NetUpgrade perl-Sys-HostnameUpgrade perl-develUpgrade perl-encoding-warningsUpgrade perl-ExtUtils-ConstantUpgrade perl-ErrnoUpgrade perl-overloadingUpgrade perl-ODBM_FileUpgrade perl-overloadUpgrade perl-Hash-Util-FieldHash-debuginfoUpgrade perl-IOUpgrade perl-libUpgrade perl-Hash-Util-debuginfoUpgrade perl-Thread-SemaphoreUpgrade perl-POSIXUpgrade perl-B-debuginfoUpgrade perl-debugsourceUpgrade perl-Devel-SelfStubberUpgrade perl-DumpvalueUpgrade perl-FileHandleUpgrade perl-diagnosticsUpgrade perl-Time-PieceUpgrade perl-GDBM_FileUpgrade perl-libnetcfgUpgrade perl-Locale-Maketext-SimpleUpgrade perl-TimeUpgrade perl-IPC-Open3Upgrade perl-IO-debuginfoUpgrade perl-I18N-Langinfo-debuginfoUpgrade perl-I18N-LanginfoUpgrade perl-File-CopyUpgrade perl-EnglishUpgrade perl-Hash-UtilUpgrade perl-SymbolUpgrade perl-localeUpgrade perl-ifUpgrade perl-Getopt-StdUpgrade perl-File-statUpgrade perl-autouseUpgrade perl-TieUpgrade perl-Text-AbbrevUpgrade perl-debuginfoUpgrade perl-Devel-Peek-debuginfoUpgrade perl-ExtUtils-EmbedUpgrade perl-docUpgrade perl-deprecateUpgrade perl-File-CompareUpgrade perl-utilsUpgrade perl-baseUpgrade perl-BUpgrade perl-openUpgrade perl-I18N-CollateUpgrade perl-FileCacheUpgrade perl-Tie-FileUpgrade perl-lessUpgrade perl-filetestUpgrade perl-DirHandleUpgrade perl-File-BasenameUpgrade perl-Fcntl-debuginfoUpgrade perl-sortUpgrade perl-Tie-MemoizeUpgrade perlUpgrade perl-Time-Piece-debuginfoUpgrade perl-mroUpgrade perl-MemoizeUpgrade perl-Math-ComplexUpgrade perl-macrosUpgrade perl-subsUpgrade perl-meta-notationUpgrade perl-varsUpgrade perl-User-pwentUpgrade perl-SafeUpgrade perl-interpreter-debuginfoUpgrade perl-FindBinUpgrade perl-vmsishUpgrade perl-Term-CompleteUpgrade perl-ODBM_File-debuginfoUpgrade perl-ThreadUpgrade perl-fieldsUpgrade perl-Pod-HtmlUpgrade perl-GDBM_File-debuginfo | Jun 9, 2026 | May 25, 2026 |
| Debian | — | Upgrade perl | Sep 21, 2026 | May 25, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | May 25, 2026 |
| Ubuntu | — | Upgrade perl-modules-5.26 (Ubuntu Pro)Upgrade perl-base (Ubuntu Pro)Upgrade perl-modules-5.40Upgrade libperl-devUpgrade perl-debug (Ubuntu Pro)Upgrade perl-modules-5.22 (Ubuntu Pro)Upgrade libperl5.22 (Ubuntu Pro)Upgrade perl-baseUpgrade perl-modules-5.30 (Ubuntu Pro)Upgrade perl (Ubuntu Pro)Upgrade perl-doc (Ubuntu Pro)Upgrade perl-debugUpgrade libperl5.30 (Ubuntu Pro)Upgrade libperl-dev (Ubuntu Pro)Upgrade libperl5.26 (Ubuntu Pro)Upgrade perlUpgrade libperl5.40 | Jun 24, 2026 | May 26, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 29, 2026 | May 25, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub