EUVD-2026-42127
GHSA-vm32-9cff-wgh2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable via a calling app with no auth (AV:N/PR:N), but only quadratic backtracking needing large input yields partial/transient CPU exhaustion, so A:L rather than the vendor's A:H.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
3DescriptionCVE.org
String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service.
The trim and rtrim functions stripped trailing whitespace with s/\s*$//u. Because \s* matches greedily and the $ anchor fails whenever a non-whitespace character follows the whitespace, the regex engine retries the match at each offset of a long whitespace run, producing quadratic backtracking. The fix replaces \s*$ with \s+$.
Any caller that passes untrusted input to trim or rtrim can trigger CPU exhaustion with a string containing a long run of whitespace.
AnalysisAI
Regular-expression denial of service in the String::Util Perl module (versions before 1.36) lets remote unauthenticated attackers exhaust CPU by supplying a string with a long run of whitespace to the trim or rtrim functions. The vulnerable s/\s*$//u pattern backtracks quadratically over whitespace runs, so any application feeding untrusted input through these helpers is exposed. No public exploit code has been identified; EPSS is low (0.19%, 9th percentile) and the flaw is not on CISA KEV, indicating no observed active exploitation.
Technical ContextAI
String::Util is a widely used CPAN utility module providing convenience string helpers for Perl applications; the affected CPE is cpe:2.3:a:bakerscot:string::util. The root cause is CWE-1333 (Inefficient Regular Expression Complexity). The original trim/rtrim implementations stripped trailing whitespace with s/\s*$//u. Because \s* is greedy and the $ anchor fails whenever a non-whitespace character follows the matched whitespace, Perl's backtracking regex engine re-attempts the match at every offset within a long whitespace run, yielding O(n²) work - classic quadratic ReDoS. The upstream fix replaces \s*$ with \s+$, which requires at least one whitespace character and eliminates the redundant zero-width retries.
RemediationAI
Vendor-released patch: 1.36 - upgrade String::Util to version 1.36 or later (via cpan/cpanm or your distribution's Perl packaging) to pick up the corrected \s+$ pattern; the fix commit is at https://github.com/scottchiefbaker/String-Util/commit/f8150867aaeb8f57c59601aefb2193f2caed8745.patch and details are in the oss-security post https://seclists.org/oss-sec/2026/q3/92 and vuldb entry https://vuldb.com/vuln/376726. If you cannot upgrade immediately, cap the maximum length of any user-supplied string before it reaches trim/rtrim (e.g. enforce a small input-size limit at the request-body or field level), which neutralizes the quadratic blow-up at the cost of rejecting legitimately long inputs; alternatively, pre-normalize or collapse whitespace, or substitute a non-backtracking trim (such as a length-bounded or non-greedy anchored variant) in hot paths. These controls trade a small amount of input flexibility for elimination of the CPU-exhaustion vector.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today