The Dumper method in Data::Dumper before 2.154, as used in Perl 5.20.1 and earlier, allows context-dependent attackers to cause a denial of service (stack consumption and crash) via an Array-Reference with many nested Array-References, which triggers a large number of recursive calls to the DD_dump function.
CVSS Details
- CVSS 3.1 Base Score: 4
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade perl | Jul 30, 2024 | Sep 30, 2014 |
| Huawei Euleros 2_0_sp2 | — | Upgrade perl-macrosUpgrade perlUpgrade perl-libsUpgrade perl-coreUpgrade perl-devel | Dec 4, 2019 | Sep 30, 2014 |
| Huawei Euleros 2_0_sp3 | — | Upgrade perlUpgrade perl-macrosUpgrade perl-libsUpgrade perl-develUpgrade perl-core | Dec 18, 2019 | Sep 30, 2014 |
| Huawei Euleros 2_0_sp5 | — | Upgrade perl-develUpgrade perl-libsUpgrade perl-coreUpgrade perl-macrosUpgrade perl | Feb 24, 2020 | Sep 30, 2014 |
| Oracle Solaris | — | Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4Upgrade runtime/perl-512 to version 5.12.5-0.175.2.4.0.4.0 on Solaris 11.2 | May 29, 2017 | Sep 30, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 18, 2014 |
| Suse | — | Upgrade perl-32bitUpgrade perl-Test-SimpleUpgrade perlUpgrade perl-Module-BuildUpgrade perl-docUpgrade perl-base-32bitUpgrade perl-baseUpgrade perl-x86 | Dec 18, 2015 | Sep 30, 2014 |
| Ubuntu | — | Upgrade perl | Mar 2, 2016 | Sep 30, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub