Perl CVE-2026-13221

Exploitation requires a Perl program that compiles a single regular expression whose alternation contains more than 65,535 fixed-string branches (the exact overflow threshold of the 16-bit delta field in Perl_study_chunk), and that uses the resulting match to gate an access, authorization, or filtering decision. The condition is concrete: the branches must be fixed strings eligible for trie optimization, and the span between the first branch and the shared tail must reach U16_MAX. Limiting factors that sharply reduce real-world exposure: such enormous alternations are almost never authored manually and typically arise only from machine-generated patterns over very large data sets; the security impact only materializes when the pattern's match result controls a trust decision; and it affects only Perl builds at or below 5.43.9. Where an application never builds regexes of this scale, the flaw is not reachable.

The published CVSS 3.1 vector (9.1, AV:N/AC:L/PR:N/UI:N/C:N/I:H/A:H) reads as a critical, trivially remote issue, but the signals conflict and should be treated with caution. The real-world trigger is highly specific: a program must compile a single regex containing more than 65,535 fixed-string branches - an extreme pattern almost never written by hand and usually only produced by machine-generated alternations built from large data sets. That makes AC:L and the network vector optimistic; realistically an attacker needs the target application to construct such a pattern and to use it for a security decision, which is why I assess AC:H. The A:H (availability) rating is also questionable: the described impact is wrong match results (an integrity problem), not a crash or resource exhaustion, so availability impact appears overstated in the input - verify with vendor. No EPSS score was provided and the CVE is not in CISA KEV; there is no evidence of active exploitation. Net assessment: a genuine correctness/integrity defect that is dangerous in the narrow set of deployments that build gigantic regex filters, but not a broad drive-by remote-code-execution priority despite the 9.1 headline.

An application builds a large deny/allow regex by joining tens of thousands of fixed strings (for example a WAF-style blocklist or an input allowlist) and uses it to decide whether a request is permitted. Because the compiled trie is silently truncated past 65,535 branches, the pattern lets through inputs it should block (false negative) or rejects legitimate inputs (false positive), enabling an attacker to bypass the filter with a string that the corrupted table mis-classifies. The fixing commit includes a deterministic reproducer test, but no weaponized exploit was identified in the source data.