Skip to main content

Perl CVE-2026-13221

CRITICAL
Integer Overflow or Wraparound (CWE-190)
2026-07-13 CPANSec
Buffer Overflow Integer Overflow Perl Shay
Critical
Disputed · 9.1 NVD
Share

Severity by source

Sources disagree (Medium–Critical)
NVD PRIMARY
9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
vuln.today AI
5.9 MEDIUM

Impact is silently wrong matches corrupting access/filter decisions, so integrity-only (I:H, C:N/A:N); the required 65,535+ fixed-string alternation is an unusual precondition, hence AC:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Red Hat
5.9 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High

Lifecycle Timeline

5
Source Code Evidence Fetched
Jul 14, 2026 - 14:23 vuln.today
Analysis Generated
Jul 14, 2026 - 14:23 vuln.today
CVSS changed
Jul 14, 2026 - 14:22 NVD
9.1 (CRITICAL)
CVE Published
Jul 13, 2026 - 15:40 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 13, 2026 - 15:40 cve.org
CRITICAL 9.1

DescriptionNVD

Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.

When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.

A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.

AnalysisAI

Silently incorrect regular-expression matching in the Perl interpreter (all versions through 5.43.9) lets an oversized alternation of more than 65,535 fixed-string branches overflow a 16-bit delta field when the branches are optimized into a trie, truncating the match-decision table. The result is both false-positive and false-negative matches, so any Perl program that uses such a pattern to gate access or filter input can make wrong security decisions. There is no public exploit identified at time of analysis, though the fixing commit ships a deterministic reproducer test, and the flaw is not listed in CISA KEV.

Technical ContextAI

The bug lives in Perl's regex compiler optimization stage, specifically Perl_study_chunk() in regcomp_study.c, which batches long chains of fixed-string alternation branches (a|b|c|...) into a trie for fast matching. During this batching the compiler stores the delta between the first branch (startbranch) and the shared tail in a 16-bit field; when tail - startbranch reaches U16_MAX the value wraps, and the trie's decision table is built from the truncated offset with no warning or error. This is a classic CWE-190 integer overflow (the vendor tags also flag it as a buffer/integer overflow). The affected component is the core Perl language runtime itself (CPE cpe:2.3:a:shay:perl), not a specific CPAN module, so the defect is present wherever the vulnerable Perl versions are installed. The upstream fix (commit 03f74bbbd3a6) simply skips trie-batching any branch set whose span would exceed U16_MAX, leaving those branches as an ordinary (correct but slower) alternation.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the official commit 03f74bbbd3a68350d926ee93d56ee4808c28c4c7 (https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch), or upgrade to the first Perl 5.44 release that includes it once your distribution ships it. Until a packaged build is available, the most effective compensating control is to avoid constructing regexes with alternations approaching 65,535 branches for any access-control or filtering decision: cap the number of alternatives, or replace a giant fixed-string alternation with a hash/set membership test (e.g. exists $set{$x}) or a trie built in application code, which sidesteps the compiler path entirely and is typically faster with no correctness risk. If you must keep such patterns, split them into multiple smaller regexes each well under the 65,535-branch limit and combine the boolean results, accepting the added code complexity. Track vendor advisories at https://github.com/Perl/perl5/issues/23388 and https://seclists.org/oss-sec/2026/q3/126 for the tagged release.

More in Perl

View all
CVE-2012-6329 HIGH POC
7.5 Jan 04

The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly hand
CVE-2017-12814 CRITICAL POC
9.8 Sep 28

Stack-based buffer overflow in the CPerlHost::Add method in win32/perlhost.h in Perl before 5.24.3-RC1 and 5.26.x before
CVE-2015-8608 CRITICAL POC
9.8 Feb 07

The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of
CVE-2018-18314 CRITICAL POC
9.8 Dec 07

Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations. Rated

CVE-2018-18312 CRITICAL POC
9.8 Dec 05

Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid
CVE-2018-18313 CRITICAL POC
9.1 Dec 07

Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive informa
CVE-2016-2381 HIGH
7.5 Apr 08

Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate e
CVE-2023-31484 HIGH POC
8.1 Apr 29

CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. Rated high severity (CVS
CVE-2016-6185 HIGH POC
7.8 Aug 02

The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which mig
CVE-2018-12015 HIGH POC
7.5 Jun 07

In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mecha
CVE-2015-8853 HIGH
7.5 May 25

The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-depe
CVE-2017-12883 CRITICAL
9.1 Sep 19

Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 al

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Micro 6.2 Affected
SLES15-SP5-CHOST-BYOS-SAP-CCloud Not-Affected
SLES15-SP6-CHOST-BYOS Not-Affected
SLES15-SP6-CHOST-BYOS-Aliyun Not-Affected
SLES15-SP6-CHOST-BYOS-Azure Not-Affected

Share

CVE-2026-13221 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy