What is the CVSS score of CVE-2026-8796?

CVE-2026-8796 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Sereal::Decoder are affected by CVE-2026-8796?

Sereal-Decoder for Perl versions before 5.005 contain a heap memory leak vulnerability allowing remote attackers to extract up to 31 bytes of sensitive data from application memory by processing…. A patch is available.

How to fix or mitigate CVE-2026-8796?

24 hours: Audit all systems using Sereal-Decoder for Perl and document current versions in use. 7 days: Upgrade Sereal-Decoder to version 5.005 or later in staging environments and validate application functionality. 30 days: Deploy patched version to all production systems and confirm successful upgrades across infrastructure.

Sereal::Decoder CVE-2026-8796

EUVD-2026-33517 HIGH

Out-of-bounds Read (CWE-125)

2026-05-31 9b29abf9-4ab0-4765-b253-1875cd9b441e

GHSA-xhpj-269v-vq2q

Information Disclosure Buffer Overflow

8.1

CVSS 3.1 · Vendor: 9b29abf9-4ab0-4765-b253-1875cd9b441e

Severity by source

Vendor (9b29abf9-4ab0-4765-b253-1875cd9b441e) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

SUSE

HIGH

qualitative

Primary rating from Vendor (9b29abf9-4ab0-4765-b253-1875cd9b441e).

CVSS VectorVendor: 9b29abf9-4ab0-4765-b253-1875cd9b441e

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jun 01, 2026 - 19:26 vuln.today

Analysis Generated

Jun 01, 2026 - 19:26 vuln.today

CVSS changed

Jun 01, 2026 - 19:22 NVD

8.1 (HIGH)

Patch available

May 31, 2026 - 21:01 EUVD

CVE Published

May 31, 2026 - 20:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Sereal::Decoder versions before 5.005 for Perl allow heap out-of-bounds read via crafted input.

In Perl/Decoder/srl_decoder.c, srl_read_object() and srl_read_hash() process a COPY tag, a back-reference whose target byte the decoder re-decodes as a fresh tag. When that target byte matches the SHORT_BINARY pattern (an inline string whose length is encoded in the low bits of the tag), the resulting read is not bounded to precede the COPY tag's own offset and can run past the end of the input buffer. An attacker controlled COPY offset can land inside a previously decoded value rather than on a tag boundary, planting a byte that the decoder reads as a SHORT_BINARY tag and consuming up to 31 following bytes from the heap as a class name (OBJECT path) or hash key (HASH path).

AnalysisAI

Heap out-of-bounds read in Sereal::Decoder for Perl before version 5.005 allows remote attackers to leak up to 31 bytes of adjacent heap memory when a victim application decodes attacker-controlled Sereal-encoded data. The flaw lives in COPY tag handling within srl_read_object() and srl_read_hash(), where a crafted COPY offset can redirect the decoder to mid-value bytes that are then re-interpreted as a SHORT_BINARY tag without bounds checking against the COPY tag's own offset. No public exploit identified at time of analysis, and EPSS is 0.01%, but a vendor patch is available in Sereal-Decoder 5.005.

Technical ContextAI

Sereal is a binary serialization protocol (similar in spirit to MessagePack or Storable) widely used in the Perl ecosystem for fast inter-process and on-disk data exchange. Sereal::Decoder is the XS/C reference decoder distributed on CPAN by YVES (metacpan.org/release/YVES/Sereal-Decoder-5.005). The vulnerability is a CWE-125 Out-of-Bounds Read inside Perl/Decoder/srl_decoder.c: the COPY tag is a back-reference instructing the decoder to re-decode a tag byte at an earlier offset in the input buffer, but srl_read_object() and srl_read_hash() failed to validate that the COPY target lies on a legitimate tag boundary preceding the COPY tag itself. When the target byte happens to match the SHORT_BINARY tag pattern (a small inline string whose length lives in the low bits of the tag), the decoder reads up to 31 following bytes from the heap as if they were a class name (OBJECT path) or hash key (HASH path), enabling disclosure of adjacent heap contents. The upstream fix in commit 303a2c69 adds an explicit from + key_len > copytag_start check in both code paths plus a stricter target_start > copytag_start guard in srl_read_extend().

RemediationAI

Vendor-released patch: upgrade Sereal::Decoder to 5.005 or later from CPAN (cpan Sereal::Decoder, cpanm Sereal::Decoder@5.005, or distro package once rebuilt); the fix is upstream commit 303a2c69cdba80bf37a3ff43461e0aa78198a7a3 which adds bounds checks against the COPY tag's own offset in srl_read_object(), srl_read_hash(), and srl_read_extend(). Refer to https://metacpan.org/release/YVES/Sereal-Decoder-5.005/changes and the oss-security announcement at http://www.openwall.com/lists/oss-security/2026/06/01/1. If immediate upgrade is impossible, compensating controls are: refuse to decode Sereal blobs originating from untrusted producers (validate provenance via signed/MACed envelopes before calling decode_sereal), isolate the decoder process under seccomp/AppArmor so a heap-leak primitive cannot reach secrets in the same address space, and consider deploying ASLR-strict and heap hardening (glibc MALLOC_PERTURB_, jemalloc opt.zero) to reduce the value of leaked bytes - these controls reduce risk but do not eliminate the OOB read and may have performance side effects.