A heap buffer overflow vulnerability was discovered in Perl.
Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10.
When there are non-ASCII bytes in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`.
$ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;' Segmentation fault (core dumped)
It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses.
CVSS Details
- CVSS 3.1 Base Score: 8.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade perl | Aug 8, 2025 | Apr 13, 2025 |
| Debian | — | Upgrade perl | Apr 15, 2025 | Apr 13, 2025 |
| Freebsd | — | Upgrade perl5.40Upgrade perl5-develUpgrade perl5.38Upgrade perl5.36 | Apr 16, 2025 | Apr 15, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade perlUpgrade perl-libs | Jun 13, 2025 | Apr 13, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade perl-libsUpgrade perl | Jul 21, 2025 | Apr 13, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade perl-libsUpgrade perl | Jul 1, 2025 | Apr 13, 2025 |
| Ibm Aix | — | Apply the fix or workaround for perl_advisory10 | Sep 25, 2025 | Jun 26, 2025 |
| Oracle_linux | — | Upgrade perl-SafeUpgrade perl-IPC-Open3Upgrade perl-vmsishUpgrade perl-varsUpgrade perl-Module-LoadedUpgrade perl-Hash-Util-FieldHashUpgrade perl-Attribute-HandlersUpgrade perl-I18N-CollateUpgrade perl-File-CompareUpgrade perl-Term-CompleteUpgrade perl-DumpvalueUpgrade perl-diagnosticsUpgrade perl-blibUpgrade perl-libnetcfgUpgrade perl-File-CopyUpgrade perl-File-BasenameUpgrade perl-Devel-PeekUpgrade perl-DBM_FilterUpgrade perl-AutoLoaderUpgrade perl-TimeUpgrade perl-ThreadUpgrade perl-SymbolUpgrade perl-openUpgrade perl-lessUpgrade perl-Text-AbbrevUpgrade perl-macrosUpgrade perl-ifUpgrade perl-ExtUtils-EmbedUpgrade perl-Search-DictUpgrade perl-BUpgrade perl-Getopt-StdUpgrade perl-overloadUpgrade perl-meta-notationUpgrade perl-File-FindUpgrade perl-FcntlUpgrade perl-FindBinUpgrade perl-baseUpgrade perl-Thread-SemaphoreUpgrade perl-File-statUpgrade perl-Tie-MemoizeUpgrade perl-TieUpgrade perl-SelfLoaderUpgrade perl-OpcodeUpgrade perl-NetUpgrade perl-IOUpgrade perl-Class-StructUpgrade perl-autouseUpgrade perl-Time-PieceUpgrade perl-DirHandleUpgrade perl-interpreterUpgrade perl-BenchmarkUpgrade perl-develUpgrade perl-SelectSaverUpgrade perl-Unicode-UCDUpgrade perl-ExtUtils-ConstantUpgrade perl-NDBM_FileUpgrade perlUpgrade perl-DynaLoaderUpgrade perl-ODBM_FileUpgrade perl-fieldsUpgrade perl-Devel-SelfStubberUpgrade perl-Locale-Maketext-SimpleUpgrade perl-filetestUpgrade perl-docUpgrade perl-Math-ComplexUpgrade perl-EnglishUpgrade perl-libUpgrade perl-localeUpgrade perl-I18N-LangTagsUpgrade perl-overloadingUpgrade perl-encoding-warningsUpgrade perl-TestUpgrade perl-NEXTUpgrade perl-ErrnoUpgrade perl-subsUpgrade perl-AutoSplitUpgrade perl-Term-ReadLineUpgrade perl-phUpgrade perl-FileCacheUpgrade perl-Hash-UtilUpgrade perl-I18N-LanginfoUpgrade perl-Tie-FileUpgrade perl-FileHandleUpgrade perl-utilsUpgrade perl-Pod-FunctionsUpgrade perl-deprecateUpgrade perl-POSIXUpgrade perl-Sys-HostnameUpgrade perl-sigtrapUpgrade perl-User-pwentUpgrade perl-debuggerUpgrade perl-mroUpgrade perl-libsUpgrade perl-ExtUtils-MiniperlUpgrade perl-File-DosGlobUpgrade perl-sortUpgrade perl-Pod-HtmlUpgrade perl-MemoizeUpgrade perl-Config-ExtensionsUpgrade perl-GDBM_File | Jul 10, 2025 | Apr 13, 2025 |
| Redhat_linux | — | Upgrade perl-Text-AbbrevUpgrade perl-varsUpgrade perl-phUpgrade perl-TestUpgrade perl-Devel-PeekUpgrade perl-FileCacheNo solution existsUpgrade perl-docUpgrade perl-Fcntl-debuginfoUpgrade perl-Opcode-debuginfoUpgrade perl-Pod-FunctionsUpgrade perl-Hash-Util-FieldHash-debuginfoUpgrade perl-Thread-SemaphoreUpgrade perl-ExtUtils-MiniperlUpgrade perl-SelfLoaderUpgrade perl-File-DosGlobUpgrade perl-GDBM_FileUpgrade perl-DynaLoaderUpgrade perl-Math-ComplexUpgrade perl-DBM_FilterUpgrade perl-Devel-SelfStubberUpgrade perl-ODBM_File-debuginfoUpgrade perl-overloadingUpgrade perl-File-DosGlob-debuginfoUpgrade perl-AutoSplitUpgrade perl-Hash-UtilUpgrade perl-B-debuginfoUpgrade perl-Config-ExtensionsUpgrade perl-File-FindUpgrade perl-debuggerUpgrade perl-deprecateUpgrade perl-libUpgrade perl-OpcodeUpgrade perl-subsUpgrade perl-sigtrapUpgrade perl-ErrnoUpgrade perl-Search-DictUpgrade perl-NDBM_FileUpgrade perl-AutoLoaderUpgrade perl-DumpvalueUpgrade perl-utilsUpgrade perl-POSIXUpgrade perl-NEXTUpgrade perl-Attribute-HandlersUpgrade perl-Class-StructUpgrade perl-blibUpgrade perl-debugsourceUpgrade perl-encoding-warningsUpgrade perl-I18N-CollateUpgrade perl-I18N-Langinfo-debuginfoUpgrade perl-POSIX-debuginfoUpgrade perl-NDBM_File-debuginfoUpgrade perl-FindBinUpgrade perl-SelectSaverUpgrade perl-libsUpgrade perl-develUpgrade perl-File-CopyUpgrade perl-I18N-LanginfoUpgrade perl-FileHandleUpgrade perl-IPC-Open3Upgrade perl-interpreter-debuginfoUpgrade perl-filetestUpgrade perl-File-BasenameUpgrade perl-baseUpgrade perl-ifUpgrade perl-vmsishUpgrade perl-Tie-MemoizeUpgrade perl-Unicode-UCDUpgrade perl-DirHandleUpgrade perl-Getopt-StdUpgrade perl-FcntlUpgrade perl-diagnosticsUpgrade perl-mro-debuginfoUpgrade perl-interpreterUpgrade perl-MemoizeUpgrade perl-Tie-FileUpgrade perl-localeUpgrade perl-libnetcfgUpgrade perl-IO-debuginfoUpgrade perl-File-statUpgrade perl-BenchmarkUpgrade perl-BUpgrade perl-Module-LoadedUpgrade perl-Devel-Peek-debuginfoUpgrade perl-Hash-Util-FieldHashUpgrade perl-User-pwentUpgrade perl-ThreadUpgrade perl-SafeUpgrade perl-macrosUpgrade perl-sortUpgrade perl-Hash-Util-debuginfoUpgrade perl-fieldsUpgrade perl-ODBM_FileUpgrade perl-Time-PieceUpgrade perl-TimeUpgrade perl-Time-Piece-debuginfoUpgrade perl-EnglishUpgrade perl-TieUpgrade perl-Term-CompleteUpgrade perl-GDBM_File-debuginfoUpgrade perl-openUpgrade perl-ExtUtils-ConstantUpgrade perl-meta-notationUpgrade perlUpgrade perl-Pod-HtmlUpgrade perl-ExtUtils-EmbedUpgrade perl-IOUpgrade perl-Locale-Maketext-SimpleUpgrade perl-File-CompareUpgrade perl-I18N-LangTagsUpgrade perl-autouseUpgrade perl-libs-debuginfoUpgrade perl-lessUpgrade perl-Sys-Hostname-debuginfoUpgrade perl-Sys-HostnameUpgrade perl-overloadUpgrade perl-debuginfoUpgrade perl-Term-ReadLineUpgrade perl-SymbolUpgrade perl-NetUpgrade perl-mro | Jul 9, 2025 | Apr 13, 2025 |
| Rocky_linux | — | Upgrade perl-develUpgrade perl-phUpgrade perl-I18N-LanginfoUpgrade perl-Hash-Util-FieldHash-debuginfoUpgrade perl-NDBM_FileUpgrade perl-File-DosGlob-debuginfoUpgrade perl-mro-debuginfoUpgrade perl-POSIX-debuginfoUpgrade perl-B-debuginfoUpgrade perl-Devel-PeekUpgrade perl-debugsourceUpgrade perl-POSIXUpgrade perl-DynaLoaderUpgrade perl-Hash-Util-FieldHashUpgrade perl-ODBM_File-debuginfoUpgrade perl-File-DosGlobUpgrade perl-OpcodeUpgrade perl-Hash-Util-debuginfoUpgrade perl-NDBM_File-debuginfoUpgrade perl-I18N-Langinfo-debuginfoUpgrade perl-libsUpgrade perl-Opcode-debuginfoUpgrade perl-libUpgrade perl-GDBM_FileUpgrade perlUpgrade perl-GDBM_File-debuginfoUpgrade perl-ODBM_FileUpgrade perl-interpreterUpgrade perl-IO-debuginfoUpgrade perl-interpreter-debuginfoUpgrade perl-BUpgrade perl-Devel-Peek-debuginfoUpgrade perl-IOUpgrade perl-ErrnoUpgrade perl-Time-Piece-debuginfoUpgrade perl-mroUpgrade perl-debuginfoUpgrade perl-Time-PieceUpgrade perl-Fcntl-debuginfoUpgrade perl-Hash-UtilUpgrade perl-libs-debuginfoUpgrade perl-Sys-Hostname-debuginfoUpgrade perl-FcntlUpgrade perl-Sys-Hostname | Oct 6, 2025 | Oct 3, 2025 |
| Ubuntu | — | Upgrade perl | Apr 15, 2025 | Apr 13, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 2, 2025 | Apr 13, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub