Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.
Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer.
A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade perl-Pod-EscapesUpgrade perl-develUpgrade perl-IO-ZlibUpgrade perl-libsUpgrade perlUpgrade perl-Package-ConstantsUpgrade perl-testsUpgrade perl-ExtUtils-InstallUpgrade perl-Object-AccessorUpgrade perl-coreUpgrade perl-Locale-Maketext-SimpleUpgrade perl-ExtUtils-CBuilderUpgrade perl-Module-CoreListUpgrade perl-Module-LoadedUpgrade perl-debuginfoUpgrade perl-macrosUpgrade perl-CPANUpgrade perl-Time-PieceUpgrade perl-ExtUtils-Embed | Jun 9, 2026 | Jun 9, 2026 |
| Amazon_linux_2023 | — | Upgrade perl-blibUpgrade perl-Devel-PeekUpgrade perl-DynaLoaderUpgrade perl-FcntlUpgrade perl-libsUpgrade perl-Module-LoadedUpgrade perl-Attribute-HandlersUpgrade perl-SelectSaverUpgrade perl-Sys-Hostname-debuginfoUpgrade perl-Pod-FunctionsUpgrade perl-testsUpgrade perl-BenchmarkUpgrade perl-NEXTUpgrade perl-interpreterUpgrade perl-OpcodeUpgrade perl-sigtrapUpgrade perl-Opcode-debuginfoUpgrade perl-AutoLoaderUpgrade perl-develUpgrade perl-Sys-HostnameUpgrade perl-Hash-Util-FieldHashUpgrade perl-ExtUtils-ConstantUpgrade perl-ExtUtils-MiniperlUpgrade perl-libs-debuginfoUpgrade perl-mro-debuginfoUpgrade perl-NetUpgrade perl-phUpgrade perl-Unicode-UCDUpgrade perl-POSIX-debuginfoUpgrade perl-Term-ReadLineUpgrade perl-Class-StructUpgrade perl-File-FindUpgrade perl-encoding-warningsUpgrade perl-NDBM_FileUpgrade perl-POSIXUpgrade perl-NDBM_File-debuginfoUpgrade perl-Thread-SemaphoreUpgrade perl-ErrnoUpgrade perl-libUpgrade perl-ODBM_FileUpgrade perl-B-debuginfoUpgrade perl-FileHandleUpgrade perl-Hash-Util-debuginfoUpgrade perl-overloadUpgrade perl-Hash-Util-FieldHash-debuginfoUpgrade perl-Devel-SelfStubberUpgrade perl-DumpvalueUpgrade perl-Config-ExtensionsUpgrade perl-debuggerUpgrade perl-IOUpgrade perl-debugsourceUpgrade perl-File-DosGlobUpgrade perl-TestUpgrade perl-I18N-LangTagsUpgrade perl-DBM_FilterUpgrade perl-SelfLoaderUpgrade perl-AutoSplitUpgrade perl-File-DosGlob-debuginfoUpgrade perl-overloadingUpgrade perl-Search-DictUpgrade perl-Time-Piece-debuginfoUpgrade perl-Tie-MemoizeUpgrade perl-File-BasenameUpgrade perl-File-statUpgrade perl-File-CompareUpgrade perl-ExtUtils-EmbedUpgrade perl-DirHandleUpgrade perlUpgrade perl-mroUpgrade perl-MemoizeUpgrade perl-Math-ComplexUpgrade perl-I18N-Langinfo-debuginfoUpgrade perl-TimeUpgrade perl-FileCacheUpgrade perl-baseUpgrade perl-BUpgrade perl-meta-notationUpgrade perl-User-pwentUpgrade perl-vmsishUpgrade perl-varsUpgrade perl-subsUpgrade perl-interpreter-debuginfoUpgrade perl-utilsUpgrade perl-Tie-FileUpgrade perl-openUpgrade perl-I18N-CollateUpgrade perl-debuginfoUpgrade perl-Pod-HtmlUpgrade perl-File-CopyUpgrade perl-Locale-Maketext-SimpleUpgrade perl-libnetcfgUpgrade perl-IPC-Open3Upgrade perl-I18N-LanginfoUpgrade perl-diagnosticsUpgrade perl-Time-PieceUpgrade perl-EnglishUpgrade perl-IO-debuginfoUpgrade perl-GDBM_FileUpgrade perl-autouseUpgrade perl-TieUpgrade perl-Text-AbbrevUpgrade perl-SymbolUpgrade perl-localeUpgrade perl-Hash-UtilUpgrade perl-Getopt-StdUpgrade perl-ifUpgrade perl-Fcntl-debuginfoUpgrade perl-sortUpgrade perl-ThreadUpgrade perl-Term-CompleteUpgrade perl-ODBM_File-debuginfoUpgrade perl-SafeUpgrade perl-GDBM_File-debuginfoUpgrade perl-FindBinUpgrade perl-fieldsUpgrade perl-macrosUpgrade perl-lessUpgrade perl-filetestUpgrade perl-deprecateUpgrade perl-docUpgrade perl-Devel-Peek-debuginfo | Jun 9, 2026 | May 25, 2026 |
| Debian | — | Upgrade perl | Sep 21, 2026 | May 25, 2026 |
| Ibm Aix | — | Apply the fix or workaround for perl_advisory14 | Sep 28, 2026 | Sep 28, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | May 25, 2026 |
| Ubuntu | — | Upgrade libperl-dev (Ubuntu Pro)Upgrade perl-debugUpgrade perlUpgrade perl-doc (Ubuntu Pro)Upgrade libperl5.30 (Ubuntu Pro)Upgrade libperl5.26 (Ubuntu Pro)Upgrade libperl5.40Upgrade perl-base (Ubuntu Pro)Upgrade perl-modules-5.40Upgrade perl-baseUpgrade perl-modules-5.22 (Ubuntu Pro)Upgrade perl-debug (Ubuntu Pro)Upgrade perl-modules-5.30 (Ubuntu Pro)Upgrade libperl5.22 (Ubuntu Pro)Upgrade perl-modules-5.26 (Ubuntu Pro)Upgrade libperl-devUpgrade perl (Ubuntu Pro) | Jun 24, 2026 | May 26, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 29, 2026 | May 25, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub