Perl
This hub aggregates every CVE we track for Perl, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
69
CVEs tracked
14
Critical
29
High
0
In CISA KEV
Severity distribution
HIGH29MEDIUM20CRITICAL14LOW6
Monthly trend
0
0
0
0
0
0
1
1
1
0
1
0
0
0
0
0
0
0
1
0
1
0
2
0
2024-092026-08
Latest CVEs
The 15 most recently published vulnerabilities affecting Perl.
- CVE-2026-13221Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk9.1
- CVE-2026-57432Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack8.4
- CVE-2026-8376Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds9.8
- CVE-2026-4176Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib9.8
- CVE-2025-40918Authen::SASL::Perl::DIGEST_MD5 versions 2.04 through 2.1800 for Perl generates the cnonce insecurely6.5
- CVE-2025-40909Perl threads have a working directory race condition where file operations may target unintended paths5.9
- CVE-2024-56406Perl is vulnerable to a heap buffer overflow when transliterating non-ASCII bytes8.4
- CVE-2025-1860Data::Entropy for Perl uses insecure rand() function for cryptographic functions7.7
- CVE-2023-47039Perl: perl for windows binary hijacking vulnerability7.8
- CVE-2023-47038Perl: write past buffer end via illegal user-defined unicode property7.0
- CVE-2022-48522In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation.9.8
- CVE-2023-31486HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.8.1
- CVE-2023-31484CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.8.1
- BDU:2023-00622Уязвимость функции pp_select () интерпретатора Perl, позволяющая нарушителю вызвать отказ в обслуживании4.4
- CVE-2020-16156CPAN 2.28 allows Signature Verification Bypass.7.8
Product normalization is registry-driven with AI assist and human review. How it works