CVE-2026-12087

Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer. Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.

Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects.

Security Fix(es):

Socket versions before 2.041 for Perl have an out-of-bounds heap read.

In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.

Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.(CVE-2026-12087)

Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects.

Security Fix(es):

Socket versions before 2.041 for Perl have an out-of-bounds heap read.

In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.

Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.(CVE-2026-12087)

Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects.

Security Fix(es):

Socket versions before 2.041 for Perl have an out-of-bounds heap read.

In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.

Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.(CVE-2026-12087)

Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects.

Security Fix(es):

Socket versions before 2.041 for Perl have an out-of-bounds heap read.

In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.

Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.(CVE-2026-12087)

Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer. Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.

Socket versions before 2.041 for Perl have an out-of-bounds heap read.

In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.

Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.

Socket versions before 2.041 for Perl have an out-of-bounds heap read. (CVE-2026-12087)

This update for perl fixes the following issues:

• CVE-2025-15649: IO:Uncompress:Unzip propagates uncaught exception when parsing zip header with malformed DOS date (bsc#1266361).
• CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds (bsc#1266304).
• CVE-2026-12087: Socket's pack_ip_mreq_source() can copy adjacent heap memory into the returned packed structure (bsc#1268349).
• CVE-2026-57432: an integer overflow in S_measure_struct leads to an out-of-bounds heap read in pack and unpack (bsc#1271372).
• CVE-2026-13221: regex trie branch-count overflow leads to silent false-positive/negative pattern matching (bsc#1271386).

Root has patched CVE-2026-12087 in the perl package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-12087 in the perl package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-12087 in the perl package for Root:Debian:13. Multiple fixed versions available.

This update for perl fixes the following issues:

• CVE-2025-15649: IO:Uncompress:Unzip propagates uncaught exception when parsing zip header with malformed DOS date (bsc#1266361).
• CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds (bsc#1266304).
• CVE-2026-12087: Socket's pack_ip_mreq_source() can copy adjacent heap memory into the returned packed structure (bsc#1268349).
• CVE-2026-57432: an integer overflow in S_measure_struct leads to an out-of-bounds heap read in pack and unpack (bsc#1271372).
• CVE-2026-13221: regex trie branch-count overflow leads to silent false-positive/negative pattern matching (bsc#1271386).

This update for perl fixes the following issues:

• CVE-2025-15649: IO:Uncompress:Unzip propagates uncaught exception when parsing zip header with malformed DOS date (bsc#1266361).
• CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds (bsc#1266304).
• CVE-2026-12087: Socket's pack_ip_mreq_source() can copy adjacent heap memory into the returned packed structure (bsc#1268349).
• CVE-2026-57432: an integer overflow in S_measure_struct leads to an out-of-bounds heap read in pack and unpack (bsc#1271372).
• CVE-2026-13221: regex trie branch-count overflow leads to silent false-positive/negative pattern matching (bsc#1271386).

This update for perl fixes the following issues

• CVE-2025-15649: IO:Uncompress:Unzip propagates uncaught exception when parsing zip header with malformed DOS date (bsc#1266361).
• CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds (bsc#1266304).
• CVE-2026-12087: Socket's pack_ip_mreq_source() can copy adjacent heap memory into the returned packed structure (bsc#1268349).
• CVE-2026-57432: an integer overflow in S_measure_struct leads to an out-of-bounds heap read in pack and unpack (bsc#1271372).
• CVE-2026-13221: regex trie branch-count overflow leads to silent false-positive/negative pattern matching (bsc#1271386).

This update for perl fixes the following issues

• CVE-2025-15649: IO:Uncompress:Unzip propagates uncaught exception when parsing zip header with malformed DOS date (bsc#1266361).
• CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds (bsc#1266304).
• CVE-2026-12087: Socket's pack_ip_mreq_source() can copy adjacent heap memory into the returned packed structure (bsc#1268349).
• CVE-2026-57432: an integer overflow in S_measure_struct leads to an out-of-bounds heap read in pack and unpack (bsc#1271372).
• CVE-2026-13221: regex trie branch-count overflow leads to silent false-positive/negative pattern matching (bsc#1271386).

This update for perl fixes the following issues:

• CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds (bsc#1266304).
• CVE-2026-12087: Socket's pack_ip_mreq_source() can copy adjacent heap memory into the returned packed structure (bsc#1268349).
• CVE-2026-57432: an integer overflow in S_measure_struct leads to an out-of-bounds heap read in pack and unpack (bsc#1271372).

This update for perl fixes the following issues:

• CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds (bsc#1266304).
• CVE-2026-12087: Socket's pack_ip_mreq_source() can copy adjacent heap memory into the returned packed structure (bsc#1268349).
• CVE-2026-57432: an integer overflow in S_measure_struct leads to an out-of-bounds heap read in pack and unpack (bsc#1271372).

It was discovered that Perl incorrectly handled short source addresses in the Socket module. An attacker could possibly use this issue to trigger an out-of-bounds heap read, resulting in information disclosure. (CVE-2026-12087)

It was discovered that Perl incorrectly handled regular expressions containing a large number of fixed string alternatives. An attacker could possibly use this issue to cause incorrect regular expression matches, resulting in security restrictions being bypassed. (CVE-2026-13221)

It was discovered that Perl incorrectly handled certain large repeat counts when processing pack and unpack templates. An attacker could possibly use this issue to trigger an out-of-bounds heap read, resulting in information disclosure. (CVE-2026-57432)

It was discovered that Perl incorrectly handled certain crafted data when deserializing with the Storable module. An attacker could possibly use this issue to trigger an integer overflow and application termination, resulting in a denial of service. (CVE-2026-57433)

USN-8675-1 fixed vulnerabilities in Perl. This update provides the corresponding fix for Perl on Ubuntu 26.04 LTS.

Original advisory details:

It was discovered that Perl incorrectly handled short source addresses in the Socket module. An attacker could possibly use this issue to trigger an out-of-bounds heap read, resulting in information disclosure. (CVE-2026-12087)

It was discovered that Perl incorrectly handled regular expressions containing a large number of fixed string alternatives. An attacker could possibly use this issue to cause incorrect regular expression matches, resulting in security restrictions being bypassed. (CVE-2026-13221)

It was discovered that Perl incorrectly handled certain large repeat counts when processing pack and unpack templates. An attacker could possibly use this issue to trigger an out-of-bounds heap read, resulting in information disclosure. (CVE-2026-57432)

It was discovered that Perl incorrectly handled certain crafted data when deserializing with the Storable module. An attacker could possibly use this issue to trigger an integer overflow and application termination, resulting in a denial of service. (CVE-2026-57433)

It was discovered that Perl incorrectly handled certain arguments to Socket and pack/unpack functions. An attacker could possibly use this issue to read sensitive information from memory. (CVE-2026-12087, CVE-2026-57432)

It was discovered that Perl incorrectly handled regular expressions with a large number of alternation branches. An attacker could possibly use this issue to cause incorrect matching results. (CVE-2026-13221)

It was discovered that Perl incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-57433, CVE-2025-15649, CVE-2026-48959, CVE-2026-9538)

It was discovered that Perl incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-48962)

It was discovered that Perl incorrectly handled credential headers during cross-origin redirects in HTTP::Tiny. An attacker could possibly use this issue to expose sensitive information. (CVE-2026-7017)