A heap buffer overflow vulnerability was discovered in Perl.
Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10.
When there are non-ASCII bytes in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`.
$ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;' Segmentation fault (core dumped)
It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses.
CVSS Details
- CVSS 3.1 Base Score: 8.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade perl | Aug 8, 2025 | Apr 13, 2025 |
| Debian | — | Upgrade perl | Apr 15, 2025 | Apr 13, 2025 |
| Freebsd | — | Upgrade perl5.36Upgrade perl5.40Upgrade perl5.38Upgrade perl5-devel | Apr 16, 2025 | Apr 15, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade perlUpgrade perl-libs | Jun 13, 2025 | Apr 13, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade perlUpgrade perl-libs | Jul 21, 2025 | Apr 13, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade perlUpgrade perl-libs | Jul 1, 2025 | Apr 13, 2025 |
| Ibm Aix | — | Apply the fix or workaround for perl_advisory10 | Sep 25, 2025 | Jun 26, 2025 |
| Oracle_linux | — | Upgrade perl-BenchmarkUpgrade perl-AutoLoaderUpgrade perl-DumpvalueUpgrade perl-SymbolUpgrade perl-interpreterUpgrade perl-SafeUpgrade perl-File-BasenameUpgrade perl-libnetcfgUpgrade perl-ifUpgrade perl-blibUpgrade perl-diagnosticsUpgrade perl-lessUpgrade perl-vmsishUpgrade perl-Text-AbbrevUpgrade perl-ExtUtils-EmbedUpgrade perl-macrosUpgrade perl-IPC-Open3Upgrade perl-overloadUpgrade perl-Thread-SemaphoreUpgrade perl-meta-notationUpgrade perl-Devel-PeekUpgrade perl-FcntlUpgrade perl-File-FindUpgrade perl-File-statUpgrade perl-baseUpgrade perl-FindBinUpgrade perl-DirHandleUpgrade perl-TimeUpgrade perl-ThreadUpgrade perl-IOUpgrade perl-DBM_FilterUpgrade perl-autouseUpgrade perl-Class-StructUpgrade perl-NetUpgrade perl-OpcodeUpgrade perl-SelfLoaderUpgrade perl-openUpgrade perl-Time-PieceUpgrade perl-File-CopyUpgrade perl-I18N-CollateUpgrade perl-BUpgrade perl-File-CompareUpgrade perl-TieUpgrade perl-Hash-Util-FieldHashUpgrade perl-Module-LoadedUpgrade perl-Attribute-HandlersUpgrade perl-varsUpgrade perl-Getopt-StdUpgrade perl-Search-DictUpgrade perl-Term-CompleteUpgrade perl-Tie-MemoizeUpgrade perl-develUpgrade perl-Term-ReadLineUpgrade perl-TestUpgrade perl-libsUpgrade perl-Sys-HostnameUpgrade perl-POSIXUpgrade perl-EnglishUpgrade perl-I18N-LangTagsUpgrade perl-encoding-warningsUpgrade perl-docUpgrade perl-DynaLoaderUpgrade perl-mroUpgrade perl-libUpgrade perl-overloadingUpgrade perl-I18N-LanginfoUpgrade perl-Hash-UtilUpgrade perl-FileCacheUpgrade perl-localeUpgrade perl-debuggerUpgrade perl-sigtrapUpgrade perl-ExtUtils-MiniperlUpgrade perl-User-pwentUpgrade perlUpgrade perl-NDBM_FileUpgrade perl-fieldsUpgrade perl-ExtUtils-ConstantUpgrade perl-ErrnoUpgrade perl-Devel-SelfStubberUpgrade perl-utilsUpgrade perl-Unicode-UCDUpgrade perl-subsUpgrade perl-phUpgrade perl-AutoSplitUpgrade perl-ODBM_FileUpgrade perl-NEXTUpgrade perl-FileHandleUpgrade perl-Tie-FileUpgrade perl-SelectSaverUpgrade perl-filetestUpgrade perl-Pod-FunctionsUpgrade perl-Locale-Maketext-SimpleUpgrade perl-Math-ComplexUpgrade perl-Pod-HtmlUpgrade perl-MemoizeUpgrade perl-GDBM_FileUpgrade perl-deprecateUpgrade perl-File-DosGlobUpgrade perl-Config-ExtensionsUpgrade perl-sort | Jul 10, 2025 | Apr 13, 2025 |
| Redhat_linux | — | Upgrade perl-debuggerUpgrade perl-deprecateUpgrade perl-ErrnoUpgrade perl-libUpgrade perl-OpcodeUpgrade perl-File-DosGlob-debuginfoUpgrade perl-develUpgrade perl-utilsUpgrade perl-Devel-PeekUpgrade perl-ODBM_File-debuginfoUpgrade perl-encoding-warningsUpgrade perl-Text-AbbrevUpgrade perl-FindBinUpgrade perl-DBM_FilterUpgrade perl-Devel-SelfStubberUpgrade perl-overloadingUpgrade perl-I18N-CollateUpgrade perl-debugsourceUpgrade perl-POSIX-debuginfoUpgrade perl-Class-StructUpgrade perl-NDBM_File-debuginfoUpgrade perl-Attribute-HandlersUpgrade perl-blibUpgrade perl-SelectSaverUpgrade perl-POSIXUpgrade perl-AutoSplitUpgrade perl-B-debuginfoUpgrade perl-NDBM_FileUpgrade perl-Config-ExtensionsUpgrade perl-Math-ComplexUpgrade perl-File-CopyUpgrade perl-DynaLoaderUpgrade perl-Hash-UtilUpgrade perl-TestUpgrade perl-Pod-FunctionsUpgrade perl-Fcntl-debuginfoUpgrade perl-Opcode-debuginfoUpgrade perl-phUpgrade perl-FileCacheUpgrade perl-I18N-Langinfo-debuginfoUpgrade perl-AutoLoaderUpgrade perl-sigtrapUpgrade perl-File-FindUpgrade perl-Search-DictUpgrade perl-subsUpgrade perl-Hash-Util-FieldHash-debuginfoNo solution existsUpgrade perl-NEXTUpgrade perl-docUpgrade perl-Thread-SemaphoreUpgrade perl-libsUpgrade perl-File-DosGlobUpgrade perl-SelfLoaderUpgrade perl-ExtUtils-MiniperlUpgrade perl-I18N-LanginfoUpgrade perl-DumpvalueUpgrade perl-GDBM_FileUpgrade perl-varsUpgrade perl-BUpgrade perl-Locale-Maketext-SimpleUpgrade perl-File-BasenameUpgrade perl-autouseUpgrade perl-Getopt-StdUpgrade perl-Sys-Hostname-debuginfoUpgrade perl-Sys-HostnameUpgrade perl-overloadUpgrade perl-lessUpgrade perl-debuginfoUpgrade perl-filetestUpgrade perl-FcntlUpgrade perl-Term-ReadLineUpgrade perl-vmsishUpgrade perl-FileHandleUpgrade perl-interpreterUpgrade perl-MemoizeUpgrade perl-diagnosticsUpgrade perl-libnetcfgUpgrade perl-IO-debuginfoUpgrade perl-BenchmarkUpgrade perl-File-statUpgrade perl-localeUpgrade perl-Tie-FileUpgrade perl-SymbolUpgrade perl-NetUpgrade perl-baseUpgrade perl-IPC-Open3Upgrade perl-ifUpgrade perl-Module-LoadedUpgrade perl-User-pwentUpgrade perl-Unicode-UCDUpgrade perl-Hash-Util-FieldHashUpgrade perl-libs-debuginfoUpgrade perl-interpreter-debuginfoUpgrade perl-sortUpgrade perl-I18N-LangTagsUpgrade perl-Time-PieceUpgrade perl-Devel-Peek-debuginfoUpgrade perl-Time-Piece-debuginfoUpgrade perl-TimeUpgrade perl-ThreadUpgrade perl-ExtUtils-ConstantUpgrade perl-mroUpgrade perlUpgrade perl-Pod-HtmlUpgrade perl-openUpgrade perl-meta-notationUpgrade perl-macrosUpgrade perl-fieldsUpgrade perl-Tie-MemoizeUpgrade perl-ODBM_FileUpgrade perl-mro-debuginfoUpgrade perl-EnglishUpgrade perl-Term-CompleteUpgrade perl-ExtUtils-EmbedUpgrade perl-DirHandleUpgrade perl-SafeUpgrade perl-Hash-Util-debuginfoUpgrade perl-File-CompareUpgrade perl-GDBM_File-debuginfoUpgrade perl-TieUpgrade perl-IO | Jul 9, 2025 | Apr 13, 2025 |
| Rocky_linux | — | Upgrade perl-Sys-Hostname-debuginfoUpgrade perl-libs-debuginfoUpgrade perl-FcntlUpgrade perl-debuginfoUpgrade perl-BUpgrade perl-mroUpgrade perl-Devel-Peek-debuginfoUpgrade perl-ErrnoUpgrade perl-Time-PieceUpgrade perl-ODBM_FileUpgrade perl-interpreter-debuginfoUpgrade perl-Hash-UtilUpgrade perl-Time-Piece-debuginfoUpgrade perl-Sys-HostnameUpgrade perlUpgrade perl-IO-debuginfoUpgrade perl-interpreterUpgrade perl-IOUpgrade perl-GDBM_File-debuginfoUpgrade perl-Fcntl-debuginfoUpgrade perl-Devel-PeekUpgrade perl-debugsourceUpgrade perl-DynaLoaderUpgrade perl-POSIX-debuginfoUpgrade perl-B-debuginfoUpgrade perl-phUpgrade perl-Opcode-debuginfoUpgrade perl-libsUpgrade perl-File-DosGlob-debuginfoUpgrade perl-develUpgrade perl-File-DosGlobUpgrade perl-OpcodeUpgrade perl-Hash-Util-debuginfoUpgrade perl-libUpgrade perl-I18N-Langinfo-debuginfoUpgrade perl-NDBM_File-debuginfoUpgrade perl-ODBM_File-debuginfoUpgrade perl-GDBM_FileUpgrade perl-NDBM_FileUpgrade perl-mro-debuginfoUpgrade perl-I18N-LanginfoUpgrade perl-Hash-Util-FieldHashUpgrade perl-POSIXUpgrade perl-Hash-Util-FieldHash-debuginfo | Oct 6, 2025 | Oct 3, 2025 |
| Ubuntu | — | Upgrade perl | Apr 15, 2025 | Apr 13, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Apr 13, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub