Perl
Monthly
OS command injection in ZoneMinder allows an authenticated user holding monitor-create or monitor-edit permission to execute arbitrary commands as the web server user by saving a Local-type monitor whose Device Path field contains shell metacharacters. The malicious stored Device value is later interpolated into shell commands in both Perl (qx()/backticks via zmdc.pl control paths and zmpkg.pl start/restart) and PHP (zmc daemon control helpers that relied on bypassable escapeshellcmd) when the monitor control or startup path runs. The issue is fixed in 1.39.2, 1.38.2, and 1.36.40, which reject any Device value not matching a strict /dev/ path pattern; no public exploit code has been identified at time of analysis, and exploitation is not confirmed actively exploited (KEV).
Memory exhaustion in Perl's ExtUtils::Typemaps::STL::List before version 1.07 allows remote attackers to cause a denial of service via an empty list processed by the OUTPUT typemap, which triggers an integer underflow and a ~32 GiB allocation. This high-severity availability-only vulnerability (CVSS 7.5, C:N/I:N/A:H) requires a compiled XS module that uses the vulnerable typemap and a reachable code path with an empty list. No public exploit code has been identified at time of analysis, and the EPSS score is low (0.18%, percentile 7%).
An out-of-bounds read in the T_STD_STRING typemap shipped with ExtUtils-Typemaps-Default before 1.06 causes the generated C++ conversion to evaluate SvCUR($arg) before stringifying the argument, so a derived XS/C++ module that passes a non-string Perl scalar (integer, number, or reference) into the std::string conversion can read an invalid length and abort or segfault the process. The defect is not present in a running service by default but is compiled into derivative XS modules, and it only triggers when the build toolchain's unspecified argument-evaluation order happens to evaluate the length macro first, so exposure is conditional rather than universal. The headline CVSS 9.1 conflicts sharply with the authoritative assessment (AC:H, C:L/A:H) and a very low EPSS of 0.19% (8th percentile); no public exploit code was identified at time of analysis.
Perl's Imager image-manipulation module before version 1.037 exits the process when it reads a RAW-format image containing an out-of-range raw_datachannels value, because the line-buffer size is computed as image width multiplied by the channel count with no range or overflow validation and the module's allocator calls exit(3) when the resulting allocation fails. The flaw is reachable only where an application uses Imager->read() on RAW data and permits the raw_datachannels parameter to come from untrusted input; a hard-coded or non-exposed value makes it unreachable. Impact is limited to denial of service - process termination with no confidentiality or integrity effect - and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; CISA's SSVC assessment rates exploitation as none, with the defect automatable but technically partial.
Reflected cross-site scripting in Webmin versions prior to 2.650 lets an attacker execute arbitrary script - and through the resulting session context, attacker-chosen commands - in the browser of an administrator who clicks a crafted link to the server's own Webmin instance. The flaw lives in the filter_javascript() sanitizer used when the core 'message' parameter is rendered through ui_alert_box() in webmin/index.cgi; because the payload is reflected only into a victim's already-authenticated admin session, exploitation is targeted and social-engineering dependent rather than autonomous. Vendor-released patch: 2.650. No public exploit code has been identified and the issue is not in CISA KEV; EPSS is only 0.30% (20th percentile) and the CISA SSVC assessment records Exploitation: none, Automatable: no, Technical Impact: partial, so the practical urgency is materially lower than the 9.6 base score suggests.
Type confusion in XS::Parse::Infix versions 0.40 through 0.49 - the Perl XS module distributed as part of XS-Parse-Keyword - lets an attacker who can influence a list handed to a list-associative infix operator (for example the zip operator from Syntax::Operator::Zip) make the interpreter dereference an address of the attacker's choosing. Supplying a bare number where an array reference is expected reliably segfaults the process (denial of service), while a crafted string carrying 0x0b at byte 12 slips past the faulty reference guard and is treated as an AV head, so bytes 16-23 are used as AvARRAY and its entries are pushed onto the Perl stack as live SVs, yielding a limited out-of-bounds read / information-disclosure primitive. Publicly available exploit code exists (a minimal zip-based proof-of-concept is described by the reporter), but there is no confirmed active exploitation (no CISA KEV listing) and EPSS is low at 0.18% (7th percentile); this is a library flaw with no standalone attack surface, so real-world risk depends entirely on whether a consuming application passes untrusted, attacker-influenced data into such an operator.
An authorization-code interception attack against public OIDC Relying Parties on LemonLDAP::NG::Portal 2.23.0 through 2.23.3 lets an attacker redeem a stolen code for the victim's access, ID and refresh tokens without knowing the client secret, which is precisely the theft PKCE is designed to prevent. The flaw only applies to Relying Parties flagged as public while oidcRPMetaDataOptionsRequirePKCE is set to 2 ('PKCE or secret' mode), a configuration that Dynamic Client Registration creates automatically for every RP, making exposure broad on affected deployments. Exploitation is not confirmed in the wild (no CISA KEV listing), but publicly available exploit code exists and CISA SSVC rates the issue exploitable with total technical impact; EPSS is only 0.22% (11th percentile), and the independent assessment sets attack complexity to High because the attacker must first obtain a valid authorization code issued to a public RP before the token exchange succeeds. No authentication is required for the token-endpoint step (CVSS PR:N), and the victim's only involvement is completing a normal login.
Unauthenticated OAuth2 token introspection against LemonLDAP::NG Portal lets an attacker who already holds a valid access token and knows the client_id of any Relying Party configured as 'public' confirm that the token is active and read its metadata, including scope, audience, expiry and the sub claim. The flaw sits in checkEndPointAuthenticationCredentials(), which skips the client-secret comparison for public Relying Parties yet still reports a deduced authentication method (client_secret_basic or client_secret_post), so a request with a public client_id and an arbitrary or empty secret passes introspection()'s authentication gate in versions 2.20.0 before 2.21.6 and 2.22.0 before 2.23.4. Because the returned sub is computed using the calling Relying Party's user identifier attribute, an attacker can correlate a user identifier across Relying Parties, defeating per-client and pseudonymous identifiers; CVSS vector PR:N makes this unauthenticated at the protocol level, but in practice exploitation requires possession of a live token plus knowledge of a public client_id, so no public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is 0.21% (10th percentile). Vendor patches are released as 2.21.6 and 2.23.4.
Catalyst::Seal before 0.03 memoises how a request path resolved using the path alone as the cache key, so an unauthenticated GET to a path whose action is declared POST-only poisons that entry and permanently disables the route for every later request in the same Perl process, including the legitimate POST. Where a POST-only action sits below a shallower action on the same path, a priming GET memoises the shallow route and a subsequent POST is dispatched there, skipping the deeper controller's auto() authorization guard. Exploitation requires a Catalyst application that has installed this non-default module; no public exploit has been identified at time of analysis and EPSS is low at 0.35% (26th percentile), while our independent assessment revises the impact down from the vendor-reported C:H/I:H/A:H to C:L/I:L/A:L (unauth., AV:N/AC:L/PR:N/UI:N/S:U), reflecting functional denial plus a possibility of an authorization check not running rather than a full compromise.
Type confusion in the Perl DBI module's fetchrow_hashref implementation allows an application that assigns a non-string scalar (integer/IV or float/NV) to the FetchHashKeyName attribute and then calls fetchrow_hashref to trigger an out-of-bounds memory read, typically crashing the Perl process (denial of service) and, in principle, exposing adjacent heap memory in error output. Affected are DBI releases before 1.654 on any platform where the module is installed; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) rates this unauthenticated and remotely triggerable, though independent assessment raises attack complexity to AC:H because exploitation requires the hosting application to propagate attacker-controlled data into a statement-handle attribute that is normally set by the application itself. No public exploit code has been identified at time of analysis, no confirmed active exploitation (not in CISA KEV), and EPSS is low at 0.21% (10th percentile), reflecting the narrow precondition of application-specific attribute misuse.
Crypt::SelfCertificate versions 1.01 through 1.05 for Perl ship embedded malware: the module's generate_certificate routine launches a Python dropper disguised as a certificate sample file, which decodes a base64-obfuscated URL, fetches the response body over HTTP, and executes it in memory under the privileges of the invoking user. Any host that installs one of these CPAN releases and then calls the function is exposed to arbitrary code execution with high confidentiality, integrity, and availability impact (assessed CVSS 3.1 base 7.8, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); exploitation is unauthenticated per the vector but requires the victim to install the package and trigger the function, and there is no public exploit identified at time of analysis. Because the payload is fetched and run without writing a script to disk, it behaves as a fileless stage and leaves minimal on-host artifact beyond the installed module itself - a genuine, high-priority supply-chain compromise rather than an inflated score.
Malformed UTF-8 passed directly to Perl's Net::IDN::Punycode encode_punycode() before version 2.590 can push the interpreter into an unending loop, abort the process, or return a Punycode label that encodes bytes the input never contained, depending on the Perl version and which backend is selected. Only code paths that call the low-level encoder itself on attacker-influenced, UTF-8-flagged byte strings are exposed, since the documented domain_to_ascii() and email_to_ascii() wrappers perform a Unicode property match first and die on such input, and the decoder is unaffected. The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, with an independent assessment adding I:L for the wrong-label case), EPSS is 0.16% at the 6th percentile, CISA SSVC records Exploitation: none and Automatable: yes with partial technical impact, and no public exploit is identified at time of analysis, although the upstream fix commits do include regression tests that reproduce the malformed-input condition.
CPU exhaustion in Net::IDN::UTS46 before version 2.590 lets a single crafted overlong IDN label consume disproportionate CPU, because to_ascii punycode-encodes each label before applying the 63-byte DNS length check and the RFC 3492 encoder's outer loop runs once per distinct non-ASCII code point while rescanning the whole label each pass. Remote, unauthenticated attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, availability-only impact A:H) who can reach Perl code that normalizes untrusted hostnames or email addresses through to_ascii, domain_to_ascii, or email_to_ascii can stall a request or worker with one input string. No public exploit code has been identified at time of analysis, the vulnerability is not in CISA KEV, and EPSS is low at 0.15% (5th percentile), so this is a genuine but bounded availability risk rather than a broadly exploited one.
The pure-Perl punycode decoder in Net::IDN::Punycode::PP, shipped in Perl Net-IDN-Encode distributions before 2.590, silently decodes a truncated label into a name that contains a code point the label never encoded, while the compiled XS backend rejects that same label - a parser differential an unauthenticated remote sender can trigger by supplying a malformed punycode label (for example 'NMzZNlL6SU', 'abc-td' or 'z'). Only installations where the XS backend does not build and the pure-Perl path is used are exposed, and the discrepancy only becomes a security problem when the decoded name feeds a security-relevant decision (allowlisting, host matching, deduplication) that is expected to agree with a system running the XS backend. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is only 0.15% (4th percentile), and the vendor's 9.1 severity rating materially overstates the realistic risk given the constrained backend dependency and the lack of any demonstrated downstream impact.
CPU exhaustion in Net::IDN::Punycode before 2.590 lets unauthenticated remote attackers pin the CPU of a Perl application by supplying an over-long label to the to-Unicode decoder (domain_to_unicode or uts46_to_unicode), which performs quadratic work as it inserts each decoded code point. The flaw is availability-only (C:N/I:N) and requires no authentication, no user interaction, and no non-default configuration - the only prerequisite is that an application forwards attacker-controlled labels into the to-Unicode direction, since the 63-byte DNS length limit is enforced solely in the to-ASCII direction. A fix is available in the 2.590 release and in two upstream commits (00d7234, 447c6b3); no public exploit code was identified at time of analysis.
Repeatedly feeding malformed labels to the XS backend of Net::IDN::Punycode (Net::IDN::Encode, versions 2.302 up to but not including 2.590) leaks an unfreed output buffer on every rejected call, allowing an unauthenticated remote sender to grow a host process's memory by roughly twice the label length per rejection and eventually cause a denial of service. Because the to-Unicode direction enforces no 63-byte DNS label limit (that check exists only on the ASCII side), the leak is unbounded per call and requires no successful decode at all - only a host application that passes attacker-controlled data into decode_punycode (or encode_punycode) while using the compiled XS backend, not the pure-Perl fallback. The vendor rated this 9.1 with high confidentiality impact, but independent assessment classifies it as availability-only (CWE-401): the leaked object is an unshared output buffer, so no data is disclosed to the attacker, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Heap use-after-free in the XS backend of Net::IDN::Punycode 2.301 through 2.589 allows an attacker-supplied punycode label that decodes to enough code points above U+FFFF to corrupt memory in the decoding Perl process, granting both read and write access to freed heap memory (CWE-416, CVSS 8.4). The defect was introduced by the 2.301 fix for CVE-2016-15059 and is confined to the XS implementation; deployments using the pure-Perl backend are not affected, and no public exploit code has been identified at time of analysis. Reachability depends on whether the consuming application feeds untrusted punycode into decode_punycode (for example IDN hostnames or internationalized email addresses), but the vulnerable call itself requires no authentication (CVSS PR:N).
Unauthenticated path traversal in the Dancer2 Perl web framework (versions 2.1.0 up to but not including 2.2.0) lets a remote attacker read arbitrary files that the worker process can access, including configuration files such as config.yml stored above public_dir. The flaw only manifests in a non-default deployment where the application names File in its route_handlers configuration and sets static_handler to 0 - because the default static handler refuses dot segments before the File route executes; applications left at defaults are not affected. The vendor has released Dancer2 2.2.0 with a containment fix, EPSS is low (0.19%, 8th percentile), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Security-control bypass in the Dancer2 Perl web framework (2.0.0 through 2.1.x) lets a refused route execute anyway: when an application enforces an authorization or security check by having a 'before' hook die and also registers an on_hook_exception handler that halts the response, the post-exception cleanup still runs and destroys the request, response and session the dispatcher needs, so the route body the hook meant to refuse runs and its writes land. The flaw requires that specific non-default application design - apps that do not refuse via dying hooks, or whose exception handler does not halt the response, are not affected - and, when the pattern is present, a single unauthenticated remote request is enough to trigger it (AV:N/AC:L/PR:N/UI:N), giving a high integrity impact on denial-protected state changes. EPSS is 0.17% (7th percentile) and there is no public exploit identified at time of analysis; CISA's SSVC rates exploitation as none, automatable as yes, technical impact partial. Vendor-released patch: Dancer2 2.2.0, which adds a halt check to the cleanup guard and makes hook compilation idempotent.
Formatting an attacker-supplied POD document with Pod::Text (part of the podlators distribution) before version 6.1.1 drives the formatter into a non-terminating loop that exhausts CPU and memory, allowing a remote unauthenticated attacker who controls the POD content to deny service to any application or service that renders untrusted POD. The trigger is a document with deeply nested =over directives whose cumulative indentation makes the wrapping margin greater than or equal to the configured output width, so that wrap() has zero or negative space for text, matches the empty string in its line-splitting substitution, and appends padding forever without consuming input. Exploitation status is limited: no public exploit code was identified at time of analysis, CISA SSVC records exploitation as none, and EPSS is low at 0.21% (11th percentile), so this is a genuine but modest-priority availability issue whose real-world risk is concentrated on services that render untrusted POD rather than on the ordinary local pod2text/perldoc workflow.
Unauthenticated remote code execution affects the Interchange e-commerce platform (the interchange/interchange project) through its admin 'quick question' page, where attacker-supplied yes/no parameters flow into a reparsed [calc] template block and injected Perl is evaluated server-side. The flaw is reachable without authentication in default installations, as confirmed by the upstream fix adding a previously absent [if-mm super] superuser gate, and SSVC rates it Automatable with total technical impact; however, injected code executes inside Interchange's Safe compartment, so unrestricted, full-impact code execution additionally requires the non-default AllowGlobal directive to be enabled on the catalog being accessed. The vendor rates this 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) while our independent assessment rates it AC:H given the sandbox constraint; no public exploit code and no confirmed active exploitation were identified at time of analysis, and a vendor patch/advisory is available.
An attacker-supplied Truevision TGA image can force the Perl Imager module (versions before 1.036) to kill the entire hosting process: a colour map length of 32768 or more is read into a signed short, becomes negative, is cast to size_t, and turned into a near-SIZE_MAX allocation request that fails and makes Imager's allocator call exit(3). Exploitation requires only that the application pass untrusted image bytes to Imager->read() with TGA handling (explicit type 'tga' or auto-detection) - the CVSS vector is PR:N, so no authentication is needed, and the exit(3) is uncatchable, meaning Perl eval and Try::Tiny handlers cannot trap it and a single malicious file terminates the worker, request handler, or CLI process. Publicly available exploit code exists per the SSVC assessment (exploitation: poc), but the input does not record confirmed active exploitation (CISA KEV); the vendor CVSS of 9.1 (C:H/I:N/A:H) is overstated, since the independently assessed vector is C:N/I:N/A:H - this is a pure denial-of-service condition with no code execution, memory corruption, or data disclosure.
An out-of-bounds heap write in Imager::File::PNG 1.003 - and in the identical reader bundled with Imager releases before 1.035 - allows a crafted 8-bit, non-palette PNG carrying a tRNS transparency chunk to overflow the row buffer during decoding, corrupting the heap and crashing the process. The bug is reachable unauthenticated by any application that hands attacker-supplied image data to Imager->read() or the PNG reader, but the demonstrated and assessed impact is denial of service through a process crash, not confirmed remote code execution. Exploitation requires that the host application actually decode untrusted PNGs; the issue is not listed in CISA KEV, no public exploit code has been identified at time of analysis, and EPSS is low (0.18%, roughly the 7th percentile), though a vendor-released patch exists in Imager::File::PNG 1.004.
Externally influenced connection attributes in Perl's DBD::DBM driver (part of the DBI distribution) can cause the process to load and therefore execute arbitrary Perl module files from anywhere the process can read, because the driver passed attacker-reachable values straight to require() and Module::Load. Affected are DBI/DBD::DBM releases prior to 1.653, and this is only reachable in applications that let untrusted input control the dbm_type or dbm_mldbm connection attributes rather than hardcoding module names. The vendor-supplied CVSS 3.1 base of 9.8 (AV:N/AC:L/PR:N/UI:N) overstates real-world risk; the independent assessment rates the same impact as AV:N/AC:H/PR:N/UI:N (high attack complexity) because exploitation additionally requires an application that exposes these attributes to untrusted data and a loadable .pm gadget already present on disk. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV), and the reporter is the Ubuntu vendor channel with an ENISA EUVD record (EUVD-2026-83584).
Bundled-dependency exposure in the Image::WebP Perl module (versions 0 through 0.2, distributed by CPAN author ZAPAD) ships a statically compiled copy of libwebp 0.3.0 from 2013, which contains multiple known decoder flaws including the critical CVE-2023-4863 heap buffer overflow. Any Perl application that uses this module to decode an attacker-supplied WebP image reaches the outdated internal decoder, potentially enabling memory corruption and remote code execution. There is no public exploit identified for this specific repackaging, EPSS is low at 0.17%, and CISA SSVC records exploitation status as none - but the embedded CVE-2023-4863 was historically a high-impact, widely-abused decoder bug.
Silently incorrect regular-expression matching in the Perl interpreter (all versions through 5.43.9) lets an oversized alternation of more than 65,535 fixed-string branches overflow a 16-bit delta field when the branches are optimized into a trie, truncating the match-decision table. The result is both false-positive and false-negative matches, so any Perl program that uses such a pattern to gate access or filter input can make wrong security decisions. There is no public exploit identified at time of analysis, though the fixing commit ships a deterministic reproducer test, and the flaw is not listed in CISA KEV.
Out-of-bounds heap read in the Perl interpreter (through version 5.43.10) lets an attacker who controls a pack or unpack template disclose adjacent heap memory back to the calling program. An unchecked integer overflow in S_measure_struct wraps the running size total negative, defeating the signed-length guards on the @, X, and x position codes and walking the buffer pointer outside its bounds. No public exploit is identified at time of analysis; the flaw was reported by CPANSec with vendor patches already committed upstream.
Heap-based buffer overflow in Perl interpreters up to and including 5.43.10 on 32-bit builds lets a caller that compiles an attacker-controlled regular expression corrupt heap memory at regex compile time, with potential for code execution. The flaw stems from an integer overflow in Perl_study_chunk when optimizing a repeated fixed substring, and is rated CVSS 9.8 by NVD. EPSS is very low (0.02%, 5th percentile) and there is no public exploit identified at time of analysis; the issue is limited to 32-bit Perl builds and applications that feed untrusted input into regex compilation.
Cryptographically weak password salts in Apache::API::Password (Perl, CPAN) through v0.5.2 allow offline dictionary attacks against hashed credentials when optional secure-random modules are absent. The library's _make_salt and _make_salt_bcrypt methods silently fall back to Perl's built-in rand() - a non-cryptographic PRNG - if both Crypt::URandom and Bytes::Random::Secure are unavailable at runtime, producing predictable salt values that dramatically reduce the search space for password cracking. No public exploit code and no confirmed active exploitation are recorded; EPSS is 0.02% (4th percentile), consistent with a configuration-dependent cryptographic weakness rather than a directly triggerable remote flaw.
Perl versions 5.9.4-5.40.3, 5.41.0-5.42.1, and 5.43.0-5.43.8 bundle a vulnerable version of Compress::Raw::Zlib that inherits multiple information-disclosure vulnerabilities from a vendored zlib library, including CVE-2026-27171. Affected users running these Perl versions can experience data exposure through the bundled compression module. Vendor patches are available in Perl 5.40.4, 5.42.2, and 5.43.9 via Compress::Raw::Zlib 2.221.
The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly handle backslashes and fully qualified method names during compilation of bracket. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.0%.
Cross-origin WebSocket probing in the Punk Perl web framework (versions 0.48 up to but not including 0.55) allows a malicious web page to learn whether arbitrary GET paths, API operations, or mounted applications return a 2xx status. When Punk serves HTTP/2 or HTTP/3, an Extended CONNECT WebSocket handshake is routed as a GET by ps_serve_one, so it reaches every GET route while the Origin check - which only runs for matched websocket routes - is skipped; the handler's returned status becomes the handshake response, and any 2xx accepts the socket. Exploitation is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N) but requires user interaction (UI:R): a victim must load an attacker-controlled cross-origin page that scripts the WebSocket, and it is not exploitable over HTTP/1.1. The impact is limited to endpoint and authorization probing - no response content, integrity, or availability impact - and no public exploit code was identified at time of analysis.
Improper Unicode encoding in the pwhois command-line tool shipped with Net::Whois::Raw before 2.99044 for Perl causes WHOIS lookups for certain internationalized domain names to be sent for the wrong domain, disclosing the queried name to an unrelated registry and returning results for the incorrect domain; the Net::Whois::Raw library modules themselves are not affected. The flaw (CWE-176, CVSS 3.1 5.4, vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) is unauthenticated but requires user interaction - the victim must run pwhois against a unicode label that pwhois does not lowercase (i.e., contains uppercase letters other than ASCII/Cyrillic, or is not in NFC form) - and only the CLI path is impacted. EPSS is low at 0.18% (7th percentile), no public exploit code exists, there is no CISA KEV entry indicating active exploitation, and a vendor patch is available in release 2.99044.
Heap buffer overflow in the Perl Imager module before version 1.037 allows memory corruption inside i_gsampf_fp when a host application asks for float samples across more than one channel of an attacker-supplied paletted image, with the image's own palette controlling the bytes written past the end of the allocation. The vulnerable path is conditional rather than universal: it is only reached when an application calls getsamples() with type 'float' on a palette-type image and requests multiple channels, so real-world exposure depends on how the embedding application uses the library. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC evaluation rates exploitation as 'none' and automatable as 'no'; the vendor CVSS vector indicates low privileges required (PR:L) while our independent assessment treats the vector as unauthenticated with high attack complexity (PR:N/AC:H), so authentication requirements are not consistent across sources.
Incorrect type casting in the Perl DBI module's internal DBI::sql_type_cast routine can cause incorrect conversion results, a crash, or a limited memory over-read when an affected application invokes that routine on a Perl scalar holding an internal integer (IV) or numeric/double (NV) value that an attacker can influence. The independently assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) indicates a local, high-complexity attack requiring low privileges and no user interaction, with only low confidentiality, integrity and availability impact, and no public exploit code was identified at time of analysis. The entry is extremely data-sparse - no CVSS score or vector, no CWE, no EPSS, no CISA KEV listing and no POC were supplied - so the only substantive artifacts are a commit-message-style fix title ('Fix DBI::sql_type_cast on IV/NV') and a vendor report from Ubuntu, meaning exploitability depends entirely on whether a specific DBD driver or application actually reaches the affected code path with attacker-controlled input.
Out-of-bounds read in the XS encoder of Perl's Net::IDN::Punycode (all versions before 2.590) lets a remote attacker who can influence a string passed to encode_punycode push a single byte from outside the module's 36-entry punycode digit table into the encoded result, or crash the calling process. The flaw is a signed-integer overflow of the punycode delta accumulator in the compiled XS backend; the pure-Perl PP backend is not affected, so exposure is limited to applications that have the XS module installed and feed it attacker-controlled labels, such as IDN/domain-to-ASCII conversion pipelines. Rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L), impact is bounded to a one-byte information leak or a denial-of-service crash with no code execution or integrity impact, and no public exploit code has been identified at time of analysis; the vendor has shipped a fix in 2.590.
HTTP response splitting in the Dancer2 Perl web framework before version 2.2.0 allows an attacker to inject arbitrary response headers and split an HTTP response when an application derives a response header NAME from request-controlled data: Dancer2's headers_to_array routine strips CR and LF from header values but not from names, so a crafted name reaches the PSGI server intact and, if that server does not validate header keys, the bytes following the CRLF are written to the wire as their own header line. The issue is unauthenticated and requires no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, 6.5 Medium), but exploitation is gated by two concrete application-specific preconditions - the app must reflect attacker input into a header key rather than a value, and the underlying PSGI server must fail to reject malformed keys - so default deployments are generally not vulnerable. No CISA KEV entry exists and no public exploit code was identified at time of analysis; EPSS is 0.19% (9th percentile) and CISA SSVC records exploitation as none and automatable exploitation as no, so all signals converge on low real-world priority despite the Medium CVSS.
Layout template disclosure in Dancer2, the Perl web application framework, allows an unauthenticated remote requester to retrieve one of an application's layout templates by requesting a path that is spelled differently from, but resolves identically to, the layout directory. Versions before 2.2.0 are affected, and the flaw is reachable only when the AutoPage handler is explicitly turned on via the auto_page setting, which is off by default; the attacker exploits the gap between the handler's literal text comparison of the request path and the canonicalising lookup that follows, using a doubled slash, a dot segment, a percent-encoded slash, or a differently-cased path on a case-insensitive filesystem. Impact is confined to reading another layout template - no code execution, no credentials, no write access - and no public exploit code has been identified at time of analysis, with EPSS at 0.19% (8th percentile).
Argument injection in Proxmox Mail Gateway's pmg-api package changelog retrieval functionality lets an attacker with an authenticated high-privileged session, or an attacker who can induce a logged-in PMG administrator to make a CSRF-style request, supply malicious arguments to the underlying apt-get command. The issue is classified as CWE-88 and tracked at CVSS 4.4 with high attack complexity, required administrative privileges, low confidentiality and integrity impact, and a scope change; no public exploit identified at time of analysis. Exploitation is limited to Proxmox Mail Gateway deployments and, in the CSRF variant, requires administrator interaction, making real-world risk low-to-moderate despite the network attack vector.
Imager for Perl before 1.036 can leak uninitialised process heap memory when an application reads an attacker-supplied paletted image and then retrieves its pixels or converts it to RGB, because palette entries beyond the number of colours populated by the reader are read without being initialised. The TGA reader stores pixel indexes without validating them against the colour map, and the affected accessors (i_gpix_p, i_glin_p) mishandle indexes equal to or past the populated count, returning zeroed-but-uninitialised heap contents as pixel data. Exploitation is local (AV:L) and requires user or application interaction to load and then read back the crafted image (UI:R); no public exploit code has been identified at time of analysis and CISA KEV does not list this issue, while EPSS is very low (0.18%, 8th percentile). The vendor-released patch is Imager 1.036, which allocates and zero-initialises a full 256-entry palette and corrects the out-of-range checks.
An out-of-bounds read in the Perl Imager image module (versions 0.45_02 through 1.034, including the 1.033/1.034 development releases) lets a crafted TIFF/EXIF file cause tiff_load_ifd() to accept an IFD entry whose start offset lies outside the EXIF block, so EXIF tags returned to the caller can contain bytes read from adjacent memory or the process can crash. Any application or service that calls Imager->read() on an attacker-supplied image is affected; no authentication or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H per independent assessment), though real exposure depends on whether the deployment actually parses untrusted images and on the target platform's integer widths. There is no public exploit identified at time of analysis and EPSS is low at 0.18% (7th percentile), but a fixed release (Imager 1.035) and upstream commits are available, so patching is straightforward and low-risk.
Heap out-of-bounds reads and writes in Perl's regular expression engine through version 5.45.1 arise from a signed 32-bit integer overflow when computing the superlinear cache size in S_regmatch. When a subject string of approximately 286,331,153 bytes is matched against a pattern containing 15 or more WHILEM-participating nodes, the bit-count product overflows to 14, producing a two-byte cache allocation that is then indexed far beyond its bounds. A caller passing attacker-controlled input of this size to such a pattern can crash the Perl process or corrupt heap memory; no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
A heap buffer overflow vulnerability was discovered in Perl. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity.
A vulnerability was found in Perl. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
A vulnerability was found in perl 5.30.0 through 5.38.0. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required.
CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
A buffer overflow was found in perl-DBI < 1.643 in DBI.xs. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity.
An untrusted pointer dereference flaw was found in Perl-DBI < 1.643. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.
Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.
Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Perl 5.22 through 5.26. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Perl 5.18 through 5.26. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
Stack-based buffer overflow in the CPerlHost::Add method in win32/perlhost.h in Perl before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 on Windows allows attackers to execute arbitrary code via a long. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to disclose sensitive information or cause a denial of. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Heap-based buffer overflow in the S_regatom function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to cause a denial of service (out-of-bounds write). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of-bounds read) and possibly execute arbitrary code via a crafted (1) drive. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which might allow local users to execute arbitrary code via a Trojan horse library under. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7). Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-dependent attackers to cause a denial of service (infinite loop) via crafted utf-8. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 14.0% and no vendor patch available.
Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 27.4% and no vendor patch available.
The canonpath function in the File::Spec module in PathTools before 3.62, as used in Perl, does not properly preserve the taint attribute of data, which might allow context-dependent attackers to. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Integer underflow in regcomp.c in Perl before 5.20, as used in Apple OS X before 10.10.5 and other products, allows context-dependent attackers to execute arbitrary code or cause a denial of service. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The CGI::Application module before 4.50_50 and 4.50_51 for Perl, when run modes are not specified, allows remote attackers to obtain sensitive information (web queries and environment details) via. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Dumper method in Data::Dumper before 2.154, as used in Perl 5.20.1 and earlier, allows context-dependent attackers to cause a denial of service (stack consumption and crash) via an. Rated low severity (CVSS 2.1), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
The rehash mechanism in Perl 5.8.2 through 5.16.x allows context-dependent attackers to cause a denial of service (memory consumption and crash) via a crafted hash key. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Heap-based buffer overflow in the Perl_repeatcpy function in util.c in Perl 5.12.x before 5.12.5, 5.14.x before 5.14.3, and 5.15.x before 15.15.5 allows context-dependent attackers to cause a denial. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity.
Multiple format string vulnerabilities in dbdimp.c in DBD::Pg (aka DBD-Pg or libdbd-pg-perl) module before 2.19.0 for Perl allow remote PostgreSQL database servers to cause a denial of service. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
OS command injection in ZoneMinder allows an authenticated user holding monitor-create or monitor-edit permission to execute arbitrary commands as the web server user by saving a Local-type monitor whose Device Path field contains shell metacharacters. The malicious stored Device value is later interpolated into shell commands in both Perl (qx()/backticks via zmdc.pl control paths and zmpkg.pl start/restart) and PHP (zmc daemon control helpers that relied on bypassable escapeshellcmd) when the monitor control or startup path runs. The issue is fixed in 1.39.2, 1.38.2, and 1.36.40, which reject any Device value not matching a strict /dev/ path pattern; no public exploit code has been identified at time of analysis, and exploitation is not confirmed actively exploited (KEV).
Memory exhaustion in Perl's ExtUtils::Typemaps::STL::List before version 1.07 allows remote attackers to cause a denial of service via an empty list processed by the OUTPUT typemap, which triggers an integer underflow and a ~32 GiB allocation. This high-severity availability-only vulnerability (CVSS 7.5, C:N/I:N/A:H) requires a compiled XS module that uses the vulnerable typemap and a reachable code path with an empty list. No public exploit code has been identified at time of analysis, and the EPSS score is low (0.18%, percentile 7%).
An out-of-bounds read in the T_STD_STRING typemap shipped with ExtUtils-Typemaps-Default before 1.06 causes the generated C++ conversion to evaluate SvCUR($arg) before stringifying the argument, so a derived XS/C++ module that passes a non-string Perl scalar (integer, number, or reference) into the std::string conversion can read an invalid length and abort or segfault the process. The defect is not present in a running service by default but is compiled into derivative XS modules, and it only triggers when the build toolchain's unspecified argument-evaluation order happens to evaluate the length macro first, so exposure is conditional rather than universal. The headline CVSS 9.1 conflicts sharply with the authoritative assessment (AC:H, C:L/A:H) and a very low EPSS of 0.19% (8th percentile); no public exploit code was identified at time of analysis.
Perl's Imager image-manipulation module before version 1.037 exits the process when it reads a RAW-format image containing an out-of-range raw_datachannels value, because the line-buffer size is computed as image width multiplied by the channel count with no range or overflow validation and the module's allocator calls exit(3) when the resulting allocation fails. The flaw is reachable only where an application uses Imager->read() on RAW data and permits the raw_datachannels parameter to come from untrusted input; a hard-coded or non-exposed value makes it unreachable. Impact is limited to denial of service - process termination with no confidentiality or integrity effect - and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; CISA's SSVC assessment rates exploitation as none, with the defect automatable but technically partial.
Reflected cross-site scripting in Webmin versions prior to 2.650 lets an attacker execute arbitrary script - and through the resulting session context, attacker-chosen commands - in the browser of an administrator who clicks a crafted link to the server's own Webmin instance. The flaw lives in the filter_javascript() sanitizer used when the core 'message' parameter is rendered through ui_alert_box() in webmin/index.cgi; because the payload is reflected only into a victim's already-authenticated admin session, exploitation is targeted and social-engineering dependent rather than autonomous. Vendor-released patch: 2.650. No public exploit code has been identified and the issue is not in CISA KEV; EPSS is only 0.30% (20th percentile) and the CISA SSVC assessment records Exploitation: none, Automatable: no, Technical Impact: partial, so the practical urgency is materially lower than the 9.6 base score suggests.
Type confusion in XS::Parse::Infix versions 0.40 through 0.49 - the Perl XS module distributed as part of XS-Parse-Keyword - lets an attacker who can influence a list handed to a list-associative infix operator (for example the zip operator from Syntax::Operator::Zip) make the interpreter dereference an address of the attacker's choosing. Supplying a bare number where an array reference is expected reliably segfaults the process (denial of service), while a crafted string carrying 0x0b at byte 12 slips past the faulty reference guard and is treated as an AV head, so bytes 16-23 are used as AvARRAY and its entries are pushed onto the Perl stack as live SVs, yielding a limited out-of-bounds read / information-disclosure primitive. Publicly available exploit code exists (a minimal zip-based proof-of-concept is described by the reporter), but there is no confirmed active exploitation (no CISA KEV listing) and EPSS is low at 0.18% (7th percentile); this is a library flaw with no standalone attack surface, so real-world risk depends entirely on whether a consuming application passes untrusted, attacker-influenced data into such an operator.
An authorization-code interception attack against public OIDC Relying Parties on LemonLDAP::NG::Portal 2.23.0 through 2.23.3 lets an attacker redeem a stolen code for the victim's access, ID and refresh tokens without knowing the client secret, which is precisely the theft PKCE is designed to prevent. The flaw only applies to Relying Parties flagged as public while oidcRPMetaDataOptionsRequirePKCE is set to 2 ('PKCE or secret' mode), a configuration that Dynamic Client Registration creates automatically for every RP, making exposure broad on affected deployments. Exploitation is not confirmed in the wild (no CISA KEV listing), but publicly available exploit code exists and CISA SSVC rates the issue exploitable with total technical impact; EPSS is only 0.22% (11th percentile), and the independent assessment sets attack complexity to High because the attacker must first obtain a valid authorization code issued to a public RP before the token exchange succeeds. No authentication is required for the token-endpoint step (CVSS PR:N), and the victim's only involvement is completing a normal login.
Unauthenticated OAuth2 token introspection against LemonLDAP::NG Portal lets an attacker who already holds a valid access token and knows the client_id of any Relying Party configured as 'public' confirm that the token is active and read its metadata, including scope, audience, expiry and the sub claim. The flaw sits in checkEndPointAuthenticationCredentials(), which skips the client-secret comparison for public Relying Parties yet still reports a deduced authentication method (client_secret_basic or client_secret_post), so a request with a public client_id and an arbitrary or empty secret passes introspection()'s authentication gate in versions 2.20.0 before 2.21.6 and 2.22.0 before 2.23.4. Because the returned sub is computed using the calling Relying Party's user identifier attribute, an attacker can correlate a user identifier across Relying Parties, defeating per-client and pseudonymous identifiers; CVSS vector PR:N makes this unauthenticated at the protocol level, but in practice exploitation requires possession of a live token plus knowledge of a public client_id, so no public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is 0.21% (10th percentile). Vendor patches are released as 2.21.6 and 2.23.4.
Catalyst::Seal before 0.03 memoises how a request path resolved using the path alone as the cache key, so an unauthenticated GET to a path whose action is declared POST-only poisons that entry and permanently disables the route for every later request in the same Perl process, including the legitimate POST. Where a POST-only action sits below a shallower action on the same path, a priming GET memoises the shallow route and a subsequent POST is dispatched there, skipping the deeper controller's auto() authorization guard. Exploitation requires a Catalyst application that has installed this non-default module; no public exploit has been identified at time of analysis and EPSS is low at 0.35% (26th percentile), while our independent assessment revises the impact down from the vendor-reported C:H/I:H/A:H to C:L/I:L/A:L (unauth., AV:N/AC:L/PR:N/UI:N/S:U), reflecting functional denial plus a possibility of an authorization check not running rather than a full compromise.
Type confusion in the Perl DBI module's fetchrow_hashref implementation allows an application that assigns a non-string scalar (integer/IV or float/NV) to the FetchHashKeyName attribute and then calls fetchrow_hashref to trigger an out-of-bounds memory read, typically crashing the Perl process (denial of service) and, in principle, exposing adjacent heap memory in error output. Affected are DBI releases before 1.654 on any platform where the module is installed; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) rates this unauthenticated and remotely triggerable, though independent assessment raises attack complexity to AC:H because exploitation requires the hosting application to propagate attacker-controlled data into a statement-handle attribute that is normally set by the application itself. No public exploit code has been identified at time of analysis, no confirmed active exploitation (not in CISA KEV), and EPSS is low at 0.21% (10th percentile), reflecting the narrow precondition of application-specific attribute misuse.
Crypt::SelfCertificate versions 1.01 through 1.05 for Perl ship embedded malware: the module's generate_certificate routine launches a Python dropper disguised as a certificate sample file, which decodes a base64-obfuscated URL, fetches the response body over HTTP, and executes it in memory under the privileges of the invoking user. Any host that installs one of these CPAN releases and then calls the function is exposed to arbitrary code execution with high confidentiality, integrity, and availability impact (assessed CVSS 3.1 base 7.8, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); exploitation is unauthenticated per the vector but requires the victim to install the package and trigger the function, and there is no public exploit identified at time of analysis. Because the payload is fetched and run without writing a script to disk, it behaves as a fileless stage and leaves minimal on-host artifact beyond the installed module itself - a genuine, high-priority supply-chain compromise rather than an inflated score.
Malformed UTF-8 passed directly to Perl's Net::IDN::Punycode encode_punycode() before version 2.590 can push the interpreter into an unending loop, abort the process, or return a Punycode label that encodes bytes the input never contained, depending on the Perl version and which backend is selected. Only code paths that call the low-level encoder itself on attacker-influenced, UTF-8-flagged byte strings are exposed, since the documented domain_to_ascii() and email_to_ascii() wrappers perform a Unicode property match first and die on such input, and the decoder is unaffected. The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, with an independent assessment adding I:L for the wrong-label case), EPSS is 0.16% at the 6th percentile, CISA SSVC records Exploitation: none and Automatable: yes with partial technical impact, and no public exploit is identified at time of analysis, although the upstream fix commits do include regression tests that reproduce the malformed-input condition.
CPU exhaustion in Net::IDN::UTS46 before version 2.590 lets a single crafted overlong IDN label consume disproportionate CPU, because to_ascii punycode-encodes each label before applying the 63-byte DNS length check and the RFC 3492 encoder's outer loop runs once per distinct non-ASCII code point while rescanning the whole label each pass. Remote, unauthenticated attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, availability-only impact A:H) who can reach Perl code that normalizes untrusted hostnames or email addresses through to_ascii, domain_to_ascii, or email_to_ascii can stall a request or worker with one input string. No public exploit code has been identified at time of analysis, the vulnerability is not in CISA KEV, and EPSS is low at 0.15% (5th percentile), so this is a genuine but bounded availability risk rather than a broadly exploited one.
The pure-Perl punycode decoder in Net::IDN::Punycode::PP, shipped in Perl Net-IDN-Encode distributions before 2.590, silently decodes a truncated label into a name that contains a code point the label never encoded, while the compiled XS backend rejects that same label - a parser differential an unauthenticated remote sender can trigger by supplying a malformed punycode label (for example 'NMzZNlL6SU', 'abc-td' or 'z'). Only installations where the XS backend does not build and the pure-Perl path is used are exposed, and the discrepancy only becomes a security problem when the decoded name feeds a security-relevant decision (allowlisting, host matching, deduplication) that is expected to agree with a system running the XS backend. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is only 0.15% (4th percentile), and the vendor's 9.1 severity rating materially overstates the realistic risk given the constrained backend dependency and the lack of any demonstrated downstream impact.
CPU exhaustion in Net::IDN::Punycode before 2.590 lets unauthenticated remote attackers pin the CPU of a Perl application by supplying an over-long label to the to-Unicode decoder (domain_to_unicode or uts46_to_unicode), which performs quadratic work as it inserts each decoded code point. The flaw is availability-only (C:N/I:N) and requires no authentication, no user interaction, and no non-default configuration - the only prerequisite is that an application forwards attacker-controlled labels into the to-Unicode direction, since the 63-byte DNS length limit is enforced solely in the to-ASCII direction. A fix is available in the 2.590 release and in two upstream commits (00d7234, 447c6b3); no public exploit code was identified at time of analysis.
Repeatedly feeding malformed labels to the XS backend of Net::IDN::Punycode (Net::IDN::Encode, versions 2.302 up to but not including 2.590) leaks an unfreed output buffer on every rejected call, allowing an unauthenticated remote sender to grow a host process's memory by roughly twice the label length per rejection and eventually cause a denial of service. Because the to-Unicode direction enforces no 63-byte DNS label limit (that check exists only on the ASCII side), the leak is unbounded per call and requires no successful decode at all - only a host application that passes attacker-controlled data into decode_punycode (or encode_punycode) while using the compiled XS backend, not the pure-Perl fallback. The vendor rated this 9.1 with high confidentiality impact, but independent assessment classifies it as availability-only (CWE-401): the leaked object is an unshared output buffer, so no data is disclosed to the attacker, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Heap use-after-free in the XS backend of Net::IDN::Punycode 2.301 through 2.589 allows an attacker-supplied punycode label that decodes to enough code points above U+FFFF to corrupt memory in the decoding Perl process, granting both read and write access to freed heap memory (CWE-416, CVSS 8.4). The defect was introduced by the 2.301 fix for CVE-2016-15059 and is confined to the XS implementation; deployments using the pure-Perl backend are not affected, and no public exploit code has been identified at time of analysis. Reachability depends on whether the consuming application feeds untrusted punycode into decode_punycode (for example IDN hostnames or internationalized email addresses), but the vulnerable call itself requires no authentication (CVSS PR:N).
Unauthenticated path traversal in the Dancer2 Perl web framework (versions 2.1.0 up to but not including 2.2.0) lets a remote attacker read arbitrary files that the worker process can access, including configuration files such as config.yml stored above public_dir. The flaw only manifests in a non-default deployment where the application names File in its route_handlers configuration and sets static_handler to 0 - because the default static handler refuses dot segments before the File route executes; applications left at defaults are not affected. The vendor has released Dancer2 2.2.0 with a containment fix, EPSS is low (0.19%, 8th percentile), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Security-control bypass in the Dancer2 Perl web framework (2.0.0 through 2.1.x) lets a refused route execute anyway: when an application enforces an authorization or security check by having a 'before' hook die and also registers an on_hook_exception handler that halts the response, the post-exception cleanup still runs and destroys the request, response and session the dispatcher needs, so the route body the hook meant to refuse runs and its writes land. The flaw requires that specific non-default application design - apps that do not refuse via dying hooks, or whose exception handler does not halt the response, are not affected - and, when the pattern is present, a single unauthenticated remote request is enough to trigger it (AV:N/AC:L/PR:N/UI:N), giving a high integrity impact on denial-protected state changes. EPSS is 0.17% (7th percentile) and there is no public exploit identified at time of analysis; CISA's SSVC rates exploitation as none, automatable as yes, technical impact partial. Vendor-released patch: Dancer2 2.2.0, which adds a halt check to the cleanup guard and makes hook compilation idempotent.
Formatting an attacker-supplied POD document with Pod::Text (part of the podlators distribution) before version 6.1.1 drives the formatter into a non-terminating loop that exhausts CPU and memory, allowing a remote unauthenticated attacker who controls the POD content to deny service to any application or service that renders untrusted POD. The trigger is a document with deeply nested =over directives whose cumulative indentation makes the wrapping margin greater than or equal to the configured output width, so that wrap() has zero or negative space for text, matches the empty string in its line-splitting substitution, and appends padding forever without consuming input. Exploitation status is limited: no public exploit code was identified at time of analysis, CISA SSVC records exploitation as none, and EPSS is low at 0.21% (11th percentile), so this is a genuine but modest-priority availability issue whose real-world risk is concentrated on services that render untrusted POD rather than on the ordinary local pod2text/perldoc workflow.
Unauthenticated remote code execution affects the Interchange e-commerce platform (the interchange/interchange project) through its admin 'quick question' page, where attacker-supplied yes/no parameters flow into a reparsed [calc] template block and injected Perl is evaluated server-side. The flaw is reachable without authentication in default installations, as confirmed by the upstream fix adding a previously absent [if-mm super] superuser gate, and SSVC rates it Automatable with total technical impact; however, injected code executes inside Interchange's Safe compartment, so unrestricted, full-impact code execution additionally requires the non-default AllowGlobal directive to be enabled on the catalog being accessed. The vendor rates this 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) while our independent assessment rates it AC:H given the sandbox constraint; no public exploit code and no confirmed active exploitation were identified at time of analysis, and a vendor patch/advisory is available.
An attacker-supplied Truevision TGA image can force the Perl Imager module (versions before 1.036) to kill the entire hosting process: a colour map length of 32768 or more is read into a signed short, becomes negative, is cast to size_t, and turned into a near-SIZE_MAX allocation request that fails and makes Imager's allocator call exit(3). Exploitation requires only that the application pass untrusted image bytes to Imager->read() with TGA handling (explicit type 'tga' or auto-detection) - the CVSS vector is PR:N, so no authentication is needed, and the exit(3) is uncatchable, meaning Perl eval and Try::Tiny handlers cannot trap it and a single malicious file terminates the worker, request handler, or CLI process. Publicly available exploit code exists per the SSVC assessment (exploitation: poc), but the input does not record confirmed active exploitation (CISA KEV); the vendor CVSS of 9.1 (C:H/I:N/A:H) is overstated, since the independently assessed vector is C:N/I:N/A:H - this is a pure denial-of-service condition with no code execution, memory corruption, or data disclosure.
An out-of-bounds heap write in Imager::File::PNG 1.003 - and in the identical reader bundled with Imager releases before 1.035 - allows a crafted 8-bit, non-palette PNG carrying a tRNS transparency chunk to overflow the row buffer during decoding, corrupting the heap and crashing the process. The bug is reachable unauthenticated by any application that hands attacker-supplied image data to Imager->read() or the PNG reader, but the demonstrated and assessed impact is denial of service through a process crash, not confirmed remote code execution. Exploitation requires that the host application actually decode untrusted PNGs; the issue is not listed in CISA KEV, no public exploit code has been identified at time of analysis, and EPSS is low (0.18%, roughly the 7th percentile), though a vendor-released patch exists in Imager::File::PNG 1.004.
Externally influenced connection attributes in Perl's DBD::DBM driver (part of the DBI distribution) can cause the process to load and therefore execute arbitrary Perl module files from anywhere the process can read, because the driver passed attacker-reachable values straight to require() and Module::Load. Affected are DBI/DBD::DBM releases prior to 1.653, and this is only reachable in applications that let untrusted input control the dbm_type or dbm_mldbm connection attributes rather than hardcoding module names. The vendor-supplied CVSS 3.1 base of 9.8 (AV:N/AC:L/PR:N/UI:N) overstates real-world risk; the independent assessment rates the same impact as AV:N/AC:H/PR:N/UI:N (high attack complexity) because exploitation additionally requires an application that exposes these attributes to untrusted data and a loadable .pm gadget already present on disk. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV), and the reporter is the Ubuntu vendor channel with an ENISA EUVD record (EUVD-2026-83584).
Bundled-dependency exposure in the Image::WebP Perl module (versions 0 through 0.2, distributed by CPAN author ZAPAD) ships a statically compiled copy of libwebp 0.3.0 from 2013, which contains multiple known decoder flaws including the critical CVE-2023-4863 heap buffer overflow. Any Perl application that uses this module to decode an attacker-supplied WebP image reaches the outdated internal decoder, potentially enabling memory corruption and remote code execution. There is no public exploit identified for this specific repackaging, EPSS is low at 0.17%, and CISA SSVC records exploitation status as none - but the embedded CVE-2023-4863 was historically a high-impact, widely-abused decoder bug.
Silently incorrect regular-expression matching in the Perl interpreter (all versions through 5.43.9) lets an oversized alternation of more than 65,535 fixed-string branches overflow a 16-bit delta field when the branches are optimized into a trie, truncating the match-decision table. The result is both false-positive and false-negative matches, so any Perl program that uses such a pattern to gate access or filter input can make wrong security decisions. There is no public exploit identified at time of analysis, though the fixing commit ships a deterministic reproducer test, and the flaw is not listed in CISA KEV.
Out-of-bounds heap read in the Perl interpreter (through version 5.43.10) lets an attacker who controls a pack or unpack template disclose adjacent heap memory back to the calling program. An unchecked integer overflow in S_measure_struct wraps the running size total negative, defeating the signed-length guards on the @, X, and x position codes and walking the buffer pointer outside its bounds. No public exploit is identified at time of analysis; the flaw was reported by CPANSec with vendor patches already committed upstream.
Heap-based buffer overflow in Perl interpreters up to and including 5.43.10 on 32-bit builds lets a caller that compiles an attacker-controlled regular expression corrupt heap memory at regex compile time, with potential for code execution. The flaw stems from an integer overflow in Perl_study_chunk when optimizing a repeated fixed substring, and is rated CVSS 9.8 by NVD. EPSS is very low (0.02%, 5th percentile) and there is no public exploit identified at time of analysis; the issue is limited to 32-bit Perl builds and applications that feed untrusted input into regex compilation.
Cryptographically weak password salts in Apache::API::Password (Perl, CPAN) through v0.5.2 allow offline dictionary attacks against hashed credentials when optional secure-random modules are absent. The library's _make_salt and _make_salt_bcrypt methods silently fall back to Perl's built-in rand() - a non-cryptographic PRNG - if both Crypt::URandom and Bytes::Random::Secure are unavailable at runtime, producing predictable salt values that dramatically reduce the search space for password cracking. No public exploit code and no confirmed active exploitation are recorded; EPSS is 0.02% (4th percentile), consistent with a configuration-dependent cryptographic weakness rather than a directly triggerable remote flaw.
Perl versions 5.9.4-5.40.3, 5.41.0-5.42.1, and 5.43.0-5.43.8 bundle a vulnerable version of Compress::Raw::Zlib that inherits multiple information-disclosure vulnerabilities from a vendored zlib library, including CVE-2026-27171. Affected users running these Perl versions can experience data exposure through the bundled compression module. Vendor patches are available in Perl 5.40.4, 5.42.2, and 5.43.9 via Compress::Raw::Zlib 2.221.
The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly handle backslashes and fully qualified method names during compilation of bracket. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.0%.
Cross-origin WebSocket probing in the Punk Perl web framework (versions 0.48 up to but not including 0.55) allows a malicious web page to learn whether arbitrary GET paths, API operations, or mounted applications return a 2xx status. When Punk serves HTTP/2 or HTTP/3, an Extended CONNECT WebSocket handshake is routed as a GET by ps_serve_one, so it reaches every GET route while the Origin check - which only runs for matched websocket routes - is skipped; the handler's returned status becomes the handshake response, and any 2xx accepts the socket. Exploitation is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N) but requires user interaction (UI:R): a victim must load an attacker-controlled cross-origin page that scripts the WebSocket, and it is not exploitable over HTTP/1.1. The impact is limited to endpoint and authorization probing - no response content, integrity, or availability impact - and no public exploit code was identified at time of analysis.
Improper Unicode encoding in the pwhois command-line tool shipped with Net::Whois::Raw before 2.99044 for Perl causes WHOIS lookups for certain internationalized domain names to be sent for the wrong domain, disclosing the queried name to an unrelated registry and returning results for the incorrect domain; the Net::Whois::Raw library modules themselves are not affected. The flaw (CWE-176, CVSS 3.1 5.4, vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) is unauthenticated but requires user interaction - the victim must run pwhois against a unicode label that pwhois does not lowercase (i.e., contains uppercase letters other than ASCII/Cyrillic, or is not in NFC form) - and only the CLI path is impacted. EPSS is low at 0.18% (7th percentile), no public exploit code exists, there is no CISA KEV entry indicating active exploitation, and a vendor patch is available in release 2.99044.
Heap buffer overflow in the Perl Imager module before version 1.037 allows memory corruption inside i_gsampf_fp when a host application asks for float samples across more than one channel of an attacker-supplied paletted image, with the image's own palette controlling the bytes written past the end of the allocation. The vulnerable path is conditional rather than universal: it is only reached when an application calls getsamples() with type 'float' on a palette-type image and requests multiple channels, so real-world exposure depends on how the embedding application uses the library. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC evaluation rates exploitation as 'none' and automatable as 'no'; the vendor CVSS vector indicates low privileges required (PR:L) while our independent assessment treats the vector as unauthenticated with high attack complexity (PR:N/AC:H), so authentication requirements are not consistent across sources.
Incorrect type casting in the Perl DBI module's internal DBI::sql_type_cast routine can cause incorrect conversion results, a crash, or a limited memory over-read when an affected application invokes that routine on a Perl scalar holding an internal integer (IV) or numeric/double (NV) value that an attacker can influence. The independently assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) indicates a local, high-complexity attack requiring low privileges and no user interaction, with only low confidentiality, integrity and availability impact, and no public exploit code was identified at time of analysis. The entry is extremely data-sparse - no CVSS score or vector, no CWE, no EPSS, no CISA KEV listing and no POC were supplied - so the only substantive artifacts are a commit-message-style fix title ('Fix DBI::sql_type_cast on IV/NV') and a vendor report from Ubuntu, meaning exploitability depends entirely on whether a specific DBD driver or application actually reaches the affected code path with attacker-controlled input.
Out-of-bounds read in the XS encoder of Perl's Net::IDN::Punycode (all versions before 2.590) lets a remote attacker who can influence a string passed to encode_punycode push a single byte from outside the module's 36-entry punycode digit table into the encoded result, or crash the calling process. The flaw is a signed-integer overflow of the punycode delta accumulator in the compiled XS backend; the pure-Perl PP backend is not affected, so exposure is limited to applications that have the XS module installed and feed it attacker-controlled labels, such as IDN/domain-to-ASCII conversion pipelines. Rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L), impact is bounded to a one-byte information leak or a denial-of-service crash with no code execution or integrity impact, and no public exploit code has been identified at time of analysis; the vendor has shipped a fix in 2.590.
HTTP response splitting in the Dancer2 Perl web framework before version 2.2.0 allows an attacker to inject arbitrary response headers and split an HTTP response when an application derives a response header NAME from request-controlled data: Dancer2's headers_to_array routine strips CR and LF from header values but not from names, so a crafted name reaches the PSGI server intact and, if that server does not validate header keys, the bytes following the CRLF are written to the wire as their own header line. The issue is unauthenticated and requires no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, 6.5 Medium), but exploitation is gated by two concrete application-specific preconditions - the app must reflect attacker input into a header key rather than a value, and the underlying PSGI server must fail to reject malformed keys - so default deployments are generally not vulnerable. No CISA KEV entry exists and no public exploit code was identified at time of analysis; EPSS is 0.19% (9th percentile) and CISA SSVC records exploitation as none and automatable exploitation as no, so all signals converge on low real-world priority despite the Medium CVSS.
Layout template disclosure in Dancer2, the Perl web application framework, allows an unauthenticated remote requester to retrieve one of an application's layout templates by requesting a path that is spelled differently from, but resolves identically to, the layout directory. Versions before 2.2.0 are affected, and the flaw is reachable only when the AutoPage handler is explicitly turned on via the auto_page setting, which is off by default; the attacker exploits the gap between the handler's literal text comparison of the request path and the canonicalising lookup that follows, using a doubled slash, a dot segment, a percent-encoded slash, or a differently-cased path on a case-insensitive filesystem. Impact is confined to reading another layout template - no code execution, no credentials, no write access - and no public exploit code has been identified at time of analysis, with EPSS at 0.19% (8th percentile).
Argument injection in Proxmox Mail Gateway's pmg-api package changelog retrieval functionality lets an attacker with an authenticated high-privileged session, or an attacker who can induce a logged-in PMG administrator to make a CSRF-style request, supply malicious arguments to the underlying apt-get command. The issue is classified as CWE-88 and tracked at CVSS 4.4 with high attack complexity, required administrative privileges, low confidentiality and integrity impact, and a scope change; no public exploit identified at time of analysis. Exploitation is limited to Proxmox Mail Gateway deployments and, in the CSRF variant, requires administrator interaction, making real-world risk low-to-moderate despite the network attack vector.
Imager for Perl before 1.036 can leak uninitialised process heap memory when an application reads an attacker-supplied paletted image and then retrieves its pixels or converts it to RGB, because palette entries beyond the number of colours populated by the reader are read without being initialised. The TGA reader stores pixel indexes without validating them against the colour map, and the affected accessors (i_gpix_p, i_glin_p) mishandle indexes equal to or past the populated count, returning zeroed-but-uninitialised heap contents as pixel data. Exploitation is local (AV:L) and requires user or application interaction to load and then read back the crafted image (UI:R); no public exploit code has been identified at time of analysis and CISA KEV does not list this issue, while EPSS is very low (0.18%, 8th percentile). The vendor-released patch is Imager 1.036, which allocates and zero-initialises a full 256-entry palette and corrects the out-of-range checks.
An out-of-bounds read in the Perl Imager image module (versions 0.45_02 through 1.034, including the 1.033/1.034 development releases) lets a crafted TIFF/EXIF file cause tiff_load_ifd() to accept an IFD entry whose start offset lies outside the EXIF block, so EXIF tags returned to the caller can contain bytes read from adjacent memory or the process can crash. Any application or service that calls Imager->read() on an attacker-supplied image is affected; no authentication or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H per independent assessment), though real exposure depends on whether the deployment actually parses untrusted images and on the target platform's integer widths. There is no public exploit identified at time of analysis and EPSS is low at 0.18% (7th percentile), but a fixed release (Imager 1.035) and upstream commits are available, so patching is straightforward and low-risk.
Heap out-of-bounds reads and writes in Perl's regular expression engine through version 5.45.1 arise from a signed 32-bit integer overflow when computing the superlinear cache size in S_regmatch. When a subject string of approximately 286,331,153 bytes is matched against a pattern containing 15 or more WHILEM-participating nodes, the bit-count product overflows to 14, producing a two-byte cache allocation that is then indexed far beyond its bounds. A caller passing attacker-controlled input of this size to such a pattern can crash the Perl process or corrupt heap memory; no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
A heap buffer overflow vulnerability was discovered in Perl. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity.
A vulnerability was found in Perl. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
A vulnerability was found in perl 5.30.0 through 5.38.0. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required.
CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
A buffer overflow was found in perl-DBI < 1.643 in DBI.xs. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity.
An untrusted pointer dereference flaw was found in Perl-DBI < 1.643. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.
Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Integer Overflow vulnerability could allow attackers to cause unexpected behavior through arithmetic overflow.
Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Perl 5.22 through 5.26. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Perl 5.18 through 5.26. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
Stack-based buffer overflow in the CPerlHost::Add method in win32/perlhost.h in Perl before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 on Windows allows attackers to execute arbitrary code via a long. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to disclose sensitive information or cause a denial of. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Heap-based buffer overflow in the S_regatom function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to cause a denial of service (out-of-bounds write). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of-bounds read) and possibly execute arbitrary code via a crafted (1) drive. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which might allow local users to execute arbitrary code via a Trojan horse library under. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7). Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-dependent attackers to cause a denial of service (infinite loop) via crafted utf-8. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 14.0% and no vendor patch available.
Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 27.4% and no vendor patch available.
The canonpath function in the File::Spec module in PathTools before 3.62, as used in Perl, does not properly preserve the taint attribute of data, which might allow context-dependent attackers to. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Integer underflow in regcomp.c in Perl before 5.20, as used in Apple OS X before 10.10.5 and other products, allows context-dependent attackers to execute arbitrary code or cause a denial of service. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The CGI::Application module before 4.50_50 and 4.50_51 for Perl, when run modes are not specified, allows remote attackers to obtain sensitive information (web queries and environment details) via. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Dumper method in Data::Dumper before 2.154, as used in Perl 5.20.1 and earlier, allows context-dependent attackers to cause a denial of service (stack consumption and crash) via an. Rated low severity (CVSS 2.1), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
The rehash mechanism in Perl 5.8.2 through 5.16.x allows context-dependent attackers to cause a denial of service (memory consumption and crash) via a crafted hash key. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Heap-based buffer overflow in the Perl_repeatcpy function in util.c in Perl 5.12.x before 5.12.5, 5.14.x before 5.14.3, and 5.15.x before 15.15.5 allows context-dependent attackers to cause a denial. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity.
Multiple format string vulnerabilities in dbdimp.c in DBD::Pg (aka DBD-Pg or libdbd-pg-perl) module before 2.19.0 for Perl allow remote PostgreSQL database servers to cause a denial of service. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.