Rrwo
Monthly
Memory exhaustion in Net::CIDR::Set before 0.23 exposes any Perl application using the library to remote denial of service when untrusted input reaches `contains()` or `add()`. The `_encode` method in `lib/Net/CIDR/Set/IPv6.pm` accepted unbounded prefix lengths and allocated memory proportional to the supplied value - `::/100000000` produces a ~100 MB string and a 12.5 million-element Perl array before the input is rejected - with no authentication required (CVSS PR:N, AV:N). No public exploit is identified at time of analysis, but the 16% EPSS score is elevated for a library-level DoS, and vendor-released patch version 0.23 is confirmed available.
Entropy source compromise in Data::Entropy (Perl) before version 0.010 allows any on-path network attacker to fully control the random bytes returned by rand_bits and rand_int for every application that selects the RandomOrg or RandomnumbersInfo remote sources via with_entropy_source. The library fetches entropy over plain HTTP with no transport security, and Data::Entropy::RawSource::RandomOrg's integrity check trivially accepts any non-empty byte string, so substituted attacker-controlled responses are never rejected. A vendor-released patch is confirmed at version 0.010; no active exploitation is confirmed (EPSS 0.10%, 1st percentile, not in CISA KEV), but the deterministic nature of the flaw means any secret derived from these sources is entirely known to the attacker.
Remote code execution in Catalyst::View::Wkhtmltopdf before 0.6.1 allows unauthenticated attackers to inject arbitrary shell commands via unsanitized PDF render options such as page_size, orientation, or margins. The incomplete fix in 0.6.0 still permits injection. CVSS 9.8, EPSS 0.67% (moderate probability), CISA SSVC indicates automatable and total impact, but no active exploitation reported.
Improper input validation in the Perl module Net::CIDR::Set through version 0.20 allows attackers to bypass network access controls by submitting network masks containing Unicode digits (e.g., Arabic-Indic numerals like U+0661) or leading zeros that are silently ignored or misinterpreted. The CVSS 7.3 score reflects low-impact compromise across confidentiality, integrity, and availability via the network, with no public exploit identified at time of analysis. Applications using this module for ACL or firewall-like decisions may grant access to wider IP ranges than intended.
Denial of service in the Perl module Net::CIDR::Set through version 0.20 allows remote unauthenticated attackers to trigger indefinite recursion by submitting malformed IP address strings to the add() method. The flaw stems from missing input validation when parsing addresses, causing the parser to re-enter itself without a termination condition. No public exploit identified at time of analysis, but the issue is trivially reproducible and a fixed version 0.21 has been released on CPAN.
Header injection filtering bypass in Plack::Middleware::Security::Common (Perl) versions prior to 0.13.1 allows remote attackers to smuggle CRLF sequences and additional headers through request paths that are not double-encoded. The flaw weakens a security middleware specifically designed to prevent header injection, and while EPSS sits at 0.03% (9th percentile) with no public exploit identified at time of analysis, downstream impact depends on how reverse proxies and Plack-based servers handle the unblocked CRLF payloads.
Session ID disclosure in Catalyst::Plugin::Statsd for Perl (versions ≤0.10.0) occurs when the StatsD communication channel lacks encryption, leaking authentication tokens over unsecured UDP to remote StatsD daemons. CVSS 7.5 (High) reflects network-accessible confidentiality impact, but EPSS score of 0.03% (9th percentile) and SSVC assessment (no observed exploitation, partial technical impact) indicate limited real-world exploitation activity. Vendor advisory from GitHub Security (GHSA-gjvr-hq83-fc38) confirms the issue with related advisories for similar Plack-Middleware-Statsd vulnerability (CVE-2026-45179).
Denial of service in the Perl module Text::Minify::XS (v0.3.0 up to but excluding v0.7.8) arises because its minify functions mishandle certain malformed UTF-8 byte sequences, corrupting the heap. A remote attacker who can supply crafted text to an application that calls minify (or its alias minify_utf8) can trigger heap corruption and crash the process. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.04%), and the flaw is not in CISA KEV.
Net::CIDR::Set versions through 0.20 for Perl incorrectly accepts Unicode digits in IP addresses and CIDR netmasks, enabling network access controls to silently permit broader address ranges than intended. Applications relying on this library to enforce IP-based allowlists or blocklists may inadvertently grant or deny access to incorrect network ranges when Unicode look-alike digits (e.g., Arabic-Indic U+0661 instead of ASCII '1') are supplied as input. With no public exploit identified at time of analysis and SSVC exploitation status of none, this is a medium-severity library flaw requiring patch deployment rather than emergency response, but the automatable nature of the attack vector warrants prompt remediation in access-control-sensitive deployments.
Metric injection in Net::Statsd::Lite (Perl) affects all releases before v0.9.0, allowing unauthenticated remote attackers to inject arbitrary statsd metrics by embedding newline, colon, or pipe characters into metric names derived from untrusted input. Because the statsd wire protocol uses these characters as record separators and field delimiters, an unsanitized metric name can smuggle additional forged metrics into the UDP stream transmitted to a statsd daemon, corrupting monitoring and telemetry data. No public exploit code exists at time of analysis and the EPSS score of 0.01% (1st percentile) indicates negligible observed exploitation activity; however, the patch diff makes exploitation trivially constructible by any attacker who can influence metric name values in a vulnerable application.
Plack::Middleware::Statsd versions before 0.9.0 leak user IP addresses to unsecured statsd daemons via unencrypted UDP communication. Remote unauthenticated attackers on the same network as the statsd daemon can intercept plaintext IP addresses transmitted by the middleware. Version 0.9.0 and later disable IP logging by default and use HMAC signatures when logging is enabled, eliminating the exposure.
Memory exhaustion in Net::CIDR::Set before 0.23 exposes any Perl application using the library to remote denial of service when untrusted input reaches `contains()` or `add()`. The `_encode` method in `lib/Net/CIDR/Set/IPv6.pm` accepted unbounded prefix lengths and allocated memory proportional to the supplied value - `::/100000000` produces a ~100 MB string and a 12.5 million-element Perl array before the input is rejected - with no authentication required (CVSS PR:N, AV:N). No public exploit is identified at time of analysis, but the 16% EPSS score is elevated for a library-level DoS, and vendor-released patch version 0.23 is confirmed available.
Entropy source compromise in Data::Entropy (Perl) before version 0.010 allows any on-path network attacker to fully control the random bytes returned by rand_bits and rand_int for every application that selects the RandomOrg or RandomnumbersInfo remote sources via with_entropy_source. The library fetches entropy over plain HTTP with no transport security, and Data::Entropy::RawSource::RandomOrg's integrity check trivially accepts any non-empty byte string, so substituted attacker-controlled responses are never rejected. A vendor-released patch is confirmed at version 0.010; no active exploitation is confirmed (EPSS 0.10%, 1st percentile, not in CISA KEV), but the deterministic nature of the flaw means any secret derived from these sources is entirely known to the attacker.
Remote code execution in Catalyst::View::Wkhtmltopdf before 0.6.1 allows unauthenticated attackers to inject arbitrary shell commands via unsanitized PDF render options such as page_size, orientation, or margins. The incomplete fix in 0.6.0 still permits injection. CVSS 9.8, EPSS 0.67% (moderate probability), CISA SSVC indicates automatable and total impact, but no active exploitation reported.
Improper input validation in the Perl module Net::CIDR::Set through version 0.20 allows attackers to bypass network access controls by submitting network masks containing Unicode digits (e.g., Arabic-Indic numerals like U+0661) or leading zeros that are silently ignored or misinterpreted. The CVSS 7.3 score reflects low-impact compromise across confidentiality, integrity, and availability via the network, with no public exploit identified at time of analysis. Applications using this module for ACL or firewall-like decisions may grant access to wider IP ranges than intended.
Denial of service in the Perl module Net::CIDR::Set through version 0.20 allows remote unauthenticated attackers to trigger indefinite recursion by submitting malformed IP address strings to the add() method. The flaw stems from missing input validation when parsing addresses, causing the parser to re-enter itself without a termination condition. No public exploit identified at time of analysis, but the issue is trivially reproducible and a fixed version 0.21 has been released on CPAN.
Header injection filtering bypass in Plack::Middleware::Security::Common (Perl) versions prior to 0.13.1 allows remote attackers to smuggle CRLF sequences and additional headers through request paths that are not double-encoded. The flaw weakens a security middleware specifically designed to prevent header injection, and while EPSS sits at 0.03% (9th percentile) with no public exploit identified at time of analysis, downstream impact depends on how reverse proxies and Plack-based servers handle the unblocked CRLF payloads.
Session ID disclosure in Catalyst::Plugin::Statsd for Perl (versions ≤0.10.0) occurs when the StatsD communication channel lacks encryption, leaking authentication tokens over unsecured UDP to remote StatsD daemons. CVSS 7.5 (High) reflects network-accessible confidentiality impact, but EPSS score of 0.03% (9th percentile) and SSVC assessment (no observed exploitation, partial technical impact) indicate limited real-world exploitation activity. Vendor advisory from GitHub Security (GHSA-gjvr-hq83-fc38) confirms the issue with related advisories for similar Plack-Middleware-Statsd vulnerability (CVE-2026-45179).
Denial of service in the Perl module Text::Minify::XS (v0.3.0 up to but excluding v0.7.8) arises because its minify functions mishandle certain malformed UTF-8 byte sequences, corrupting the heap. A remote attacker who can supply crafted text to an application that calls minify (or its alias minify_utf8) can trigger heap corruption and crash the process. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.04%), and the flaw is not in CISA KEV.
Net::CIDR::Set versions through 0.20 for Perl incorrectly accepts Unicode digits in IP addresses and CIDR netmasks, enabling network access controls to silently permit broader address ranges than intended. Applications relying on this library to enforce IP-based allowlists or blocklists may inadvertently grant or deny access to incorrect network ranges when Unicode look-alike digits (e.g., Arabic-Indic U+0661 instead of ASCII '1') are supplied as input. With no public exploit identified at time of analysis and SSVC exploitation status of none, this is a medium-severity library flaw requiring patch deployment rather than emergency response, but the automatable nature of the attack vector warrants prompt remediation in access-control-sensitive deployments.
Metric injection in Net::Statsd::Lite (Perl) affects all releases before v0.9.0, allowing unauthenticated remote attackers to inject arbitrary statsd metrics by embedding newline, colon, or pipe characters into metric names derived from untrusted input. Because the statsd wire protocol uses these characters as record separators and field delimiters, an unsanitized metric name can smuggle additional forged metrics into the UDP stream transmitted to a statsd daemon, corrupting monitoring and telemetry data. No public exploit code exists at time of analysis and the EPSS score of 0.01% (1st percentile) indicates negligible observed exploitation activity; however, the patch diff makes exploitation trivially constructible by any attacker who can influence metric name values in a vulnerable application.
Plack::Middleware::Statsd versions before 0.9.0 leak user IP addresses to unsecured statsd daemons via unencrypted UDP communication. Remote unauthenticated attackers on the same network as the statsd daemon can intercept plaintext IP addresses transmitted by the middleware. Version 0.9.0 and later disable IP logging by default and use HMAC signatures when logging is enabled, eliminating the exposure.