The Dumper method in Data::Dumper before 2.154, as used in Perl 5.20.1 and earlier, allows context-dependent attackers to cause a denial of service (stack consumption and crash) via an Array-Reference with many nested Array-References, which triggers a large number of recursive calls to the DD_dump function.
CVSS Details
- CVSS 3.1 Base Score: 4
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade perl | Jul 30, 2024 | Sep 30, 2014 |
| Huawei Euleros 2_0_sp2 | — | Upgrade perl-libsUpgrade perl-coreUpgrade perl-develUpgrade perl-macrosUpgrade perl | Dec 4, 2019 | Sep 30, 2014 |
| Huawei Euleros 2_0_sp3 | — | Upgrade perl-develUpgrade perl-coreUpgrade perl-libsUpgrade perlUpgrade perl-macros | Dec 18, 2019 | Sep 30, 2014 |
| Huawei Euleros 2_0_sp5 | — | Upgrade perl-develUpgrade perl-libsUpgrade perlUpgrade perl-macrosUpgrade perl-core | Feb 24, 2020 | Sep 30, 2014 |
| Oracle Solaris | — | Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4Upgrade runtime/perl-512 to version 5.12.5-0.175.2.4.0.4.0 on Solaris 11.2 | May 29, 2017 | Sep 30, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 18, 2014 |
| Suse | — | Upgrade perl-docUpgrade perl-base-32bitUpgrade perlUpgrade perl-Module-BuildUpgrade perl-x86Upgrade perl-baseUpgrade perl-Test-SimpleUpgrade perl-32bit | Dec 18, 2015 | Sep 30, 2014 |
| Ubuntu | — | Upgrade perl | Mar 2, 2016 | Sep 30, 2014 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub