CVE-2011-10043
Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded
CVE-2011-10043 is a critical vulnerability (CVSS 9.8) in Bingos Module::load, published July 7, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.78%, the 55th percentile. Fixed in perl 5.18.1-2.
Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded.
Module names starting with "::" could be passed to the load function to specify arbitrary module paths.
Attackers able to influence module names passed to load could use that bug to execute arbitrary code.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded
Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded.
Module names starting with "::" could be passed to the load function to specify arbitrary module paths.
Attackers able to influence module names passed to load could use that bug to execute arbitrary code.
- Record
CVE-2011-10043- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-145
- Updated
- 2026-11-02
EUVDEUVD-2011-5272
Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded.
Module names starting with "::" could be passed to the load function to specify arbitrary module paths.
Attackers able to influence module names passed to load could use that bug to execute arbitrary code.
- Record
EUVD-2011-5272- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8x3h-9qcg-hv3j
Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded. ...
Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded.
Module names starting with "::" could be passed to the load function to specify arbitrary module paths.
Attackers able to influence module names passed to load could use that bug to execute arbitrary code.
- Record
GHSA-8x3h-9qcg-hv3j- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-145
- Updated
- 2026-11-02
NVD
Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded.
Module names starting with "::" could be passed to the load function to specify arbitrary module paths.
Attackers able to influence module names passed to load could use that bug to execute arbitrary code.
- Record
CVE-2011-10043- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-145
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-10043
Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded. Module names starting with "::" could be passed to the load function to specify arbitrary module paths. Attackers able to influence module names passed to load could use that bug to execute arbitrary code.
- Record
DEBIAN-CVE-2011-10043- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2011-10043
Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded. Module names starting with "::" could be passed to the load function to specify arbitrary module paths. Attackers able to influence module names passed to load could use that bug to execute arbitrary code.
- Record
UBUNTU-CVE-2011-10043- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
perlDebian:12 |
before 5.18.1-2 | 5.18.1-2 |
perlDebian:13 |
before 5.18.1-2 | 5.18.1-2 |
perlDebian:14 |
before 5.18.1-2 | 5.18.1-2 |
perlUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 5.14.2-21build15.18.1-45.18.1-4build15.18.1-55.18.2-2 Show 12 moreShow less5.18.2-2ubuntu15.18.2-2ubuntu1.15.18.2-2ubuntu1.35.18.2-2ubuntu1.45.18.2-2ubuntu1.65.18.2-2ubuntu1.75.18.2-2ubuntu1.7+esm35.18.2-2ubuntu1.7+esm45.18.2-2ubuntu1.7+esm55.18.2-2ubuntu1.7+esm75.18.2-2ubuntu1.7+esm85.18.2-2ubuntu1.7+esm9 |
None known |
perlUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 5.20.2-65.22.1-35.22.1-45.22.1-55.22.1-7 Show 11 moreShow less5.22.1-85.22.1-95.22.1-9ubuntu0.25.22.1-9ubuntu0.35.22.1-9ubuntu0.55.22.1-9ubuntu0.65.22.1-9ubuntu0.95.22.1-9ubuntu0.9+esm15.22.1-9ubuntu0.9+esm25.22.1-9ubuntu0.9+esm35.22.1-9ubuntu0.9+esm4 |
None known |
perlUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 5.26.0-8ubuntu15.26.1-2ubuntu15.26.1-35.26.1-45.26.1-4build1 Show 11 moreShow less5.26.1-55.26.1-65.26.1-6ubuntu0.15.26.1-6ubuntu0.25.26.1-6ubuntu0.35.26.1-6ubuntu0.55.26.1-6ubuntu0.65.26.1-6ubuntu0.75.26.1-6ubuntu0.7+esm25.26.1-6ubuntu0.7+esm35.26.1-6ubuntu0.7+esm4 |
None known |
perlUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 5.28.1-6build15.30.0-75.30.0-95.30.0-9build15.30.0-9ubuntu0.2 Show 6 moreShow less5.30.0-9ubuntu0.35.30.0-9ubuntu0.45.30.0-9ubuntu0.55.30.0-9ubuntu0.5+esm25.30.0-9ubuntu0.5+esm35.30.0-9ubuntu0.5+esm4 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, NVD, OSV |
References
blogs.perl.org/users/michael_g_schwern/2011/10/how-not-to-load-a-module-or-bad-interfaces-make-good-people-do-bad-things.html
metacpan.org/release/BINGOS/Module-Load-0.22/diff/BINGOS/Module-Load-0.20/lib/Module/Load.pm
nvd.nist.gov/vuln/detail/CVE-2011-10043
github.com/advisories/GHSA-8x3h-9qcg-hv3j
security-tracker.debian.org/tracker/CVE-2011-10043
ubuntu.com/security/CVE-2011-10043
cve.org/CVERecord?id=CVE-2011-10043
lists.security.metacpan.org/cve-announce/msg/41608305