EUVD-2026-54935
GHSA-2cxw-qmfc-3vx3
Severity by source
AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
AV:L and AC:H reflect highly specific local input control requirements; A:H for crash, I:L for heap corruption potential, C:N as no data exposure applies.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
5DescriptionCVE.org
Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.
The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.
A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.
AnalysisAI
Heap out-of-bounds reads and writes in Perl's regular expression engine through version 5.45.1 arise from a signed 32-bit integer overflow when computing the superlinear cache size in S_regmatch. When a subject string of approximately 286,331,153 bytes is matched against a pattern containing 15 or more WHILEM-participating nodes, the bit-count product overflows to 14, producing a two-byte cache allocation that is then indexed far beyond its bounds. A caller passing attacker-controlled input of this size to such a pattern can crash the Perl process or corrupt heap memory; no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Technical ContextAI
The vulnerability is rooted in regexec.c within Perl's NFA-based backtracking regex engine, specifically the S_regmatch function's superlinear cache. This cache stores one bit per subject position per WHILEM node to prevent exponential backtracking complexity; the total bit count is (subject_length + 1) × node_count. This product is stored as a signed 32-bit integer with no overflow check: at approximately 286,331,153 bytes subject length times 15 nodes, the result wraps around to 14 (CWE-190 Integer Overflow), causing a two-byte heap allocation. Cache reads and writes are then indexed using the actual match position and node number, reading and writing well past the allocation. The patch commits to regexec.c correct the poscache_iter counter management - replacing post-decrement comparisons against zero and negative with pre-checked equality tests - to prevent both underflow and the upstream miscalculation. The CPE cpe:2.3:a:leont:perl:*:*:*:*:*:*:*:* covers all Perl releases through 5.45.1; note that the 'leont' vendor string in this CPE is atypical for the main Perl interpreter and may reflect a CPE data quality issue rather than a specific CPAN distribution.
RemediationAI
Two upstream fix commits are available on the perl5 GitHub repository: https://github.com/Perl/perl5/commit/568e6fd238867bb9e99fa3f47cba3169009239e0.patch and https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.patch, both modifying the poscache_iter counter logic in regexec.c. A specific tagged release version incorporating these fixes has not been independently confirmed from available references; administrators should monitor Perl's official release channels and CPAN for a patched stable release. As compensating controls where immediate patching is not feasible, applications should enforce a hard maximum on input string length before passing to regex matching - strings approaching or exceeding 100MB should be rejected outright, as this directly prevents overflow of the 32-bit cache size. Developers should additionally audit application code for regex patterns with deeply nested quantifiers (patterns like (a+)+ or equivalent WHILEM-heavy constructs) and avoid applying such patterns to unbounded user input. These input-length restrictions carry minimal functional impact for legitimate use cases while eliminating the overflow precondition.
The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly hand
Stack-based buffer overflow in the CPerlHost::Add method in win32/perlhost.h in Perl before 5.24.3-RC1 and 5.26.x before
The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of
Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations. Rated
Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid
Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive informa
Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate e
CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. Rated high severity (CVS
The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which mig
In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mecha
The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-depe
Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 al
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today