What is the CVSS score of CVE-2026-57433?

CVE-2026-57433 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Storable are affected by CVE-2026-57433?

Storable module for Perl versions prior to 3.41 contains a critical denial-of-service vulnerability exploitable remotely through crafted deserialization requests.. A patch is available.

How to fix or mitigate CVE-2026-57433?

Within 24 hours, audit all systems and applications using Perl's Storable module to identify those running versions before 3.41. Within 7 days, procure and test Storable version 3.41 or later in staging environments to validate application compatibility. Within 30 days, deploy the patched Storable 3.41+ across all production and development systems, prioritizing internet-facing services and critical business applications.

Storable CVE-2026-57433

CRITICAL

Integer Overflow or Wraparound (CWE-190)

2026-07-13 CPANSec

Deserialization Integer Overflow Red Hat Storable Haarg

9.8

CVSS 3.1 · Vendor: CPANSec

Severity by source

Vendor (CPANSec) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (CPANSec).

CVSS VectorVendor: CPANSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 14, 2026 - 14:23 vuln.today

Analysis Generated

Jul 14, 2026 - 14:23 vuln.today

CVSS changed

Jul 14, 2026 - 14:22 NVD

9.8 (CRITICAL)

CVE Published

Jul 13, 2026 - 15:37 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 13, 2026 - 15:37 cve.org

CRITICAL 9.8

DescriptionCVE.org

Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.

retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.

A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.

AnalysisAI

Denial-of-service in the Storable module for Perl (versions before 3.41) allows remote attackers to abort deserialization by supplying a crafted SX_HOOK record whose item count equals I32_MAX. The signed 32-bit count plus one wraps to a negative value, which av_extend rejects with a fatal panic, terminating any thaw() or retrieve() call on attacker-controlled data. No public exploit identified at time of analysis; despite the assigned CVSS of 9.8 (C:H/I:H/A:H), the documented outcome is a controlled abort rather than memory corruption or code execution.