CVE-2026-13221

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.

Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects.

Security Fix(es):

Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.

When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.

A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.(CVE-2026-13221)

Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects.

Security Fix(es):

Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.

When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.

A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.(CVE-2026-13221)

Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects.

Security Fix(es):

Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.

When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.

A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.(CVE-2026-13221)

Perl is a high-level programming language that is commonly used for system administration utilities and web programming.

Security Fix(es):

• perl: Perl: Incorrect regular expression processing via large regular expressions (CVE-2026-13221)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Perl is a high-level programming language that is commonly used for system administration utilities and web programming.

Security Fix(es):

• perl: Perl: Incorrect regular expression processing via large regular expressions (CVE-2026-13221)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Perl is a high-level programming language that is commonly used for system administration utilities and web programming.

Security Fix(es):

• perl: Perl: Incorrect regular expression processing via large regular expressions (CVE-2026-13221)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Perl is a high-level programming language that is commonly used for system administration utilities and web programming.

Security Fix(es):

• perl: Perl: Incorrect regular expression processing via large regular expressions (CVE-2026-13221)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.

Perl is a high-level programming language that is commonly used for system administration utilities and web programming.

Security Fix(es):

• perl: Perl: Incorrect regular expression processing via large regular expressions (CVE-2026-13221)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Perl is a high-level programming language that is commonly used for system administration utilities and web programming.

Security Fix(es):

• perl: Perl: Incorrect regular expression processing via large regular expressions (CVE-2026-13221)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Perl is a high-level programming language that is commonly used for system administration utilities and web programming.

Security Fix(es):

• perl: Perl: Incorrect regular expression processing via large regular expressions (CVE-2026-13221)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Perl is a high-level programming language that is commonly used for system administration utilities and web programming.

Security Fix(es):

• perl: Perl: Incorrect regular expression processing via large regular expressions (CVE-2026-13221)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.

When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.

A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.

• CVE-2026-13221: regex trie 16-bit field overflow in Perl_study_chunk produces silently incorrect matches
• CVE-2026-57432: integer overflow in S_measure_struct leads to out-of-bounds heap read in pack/unpack

• CVE-2026-13221: regex trie 16-bit field overflow in Perl_study_chunk produces silently incorrect matches
• CVE-2026-57432: integer overflow in S_measure_struct leads to out-of-bounds heap read in pack/unpack

• SECURITY UPDATE: silently incorrect regular expression matches from oversized tries
  • debian/patches/CVE-2026-13221.patch: skip building a trie when the delta between the first branch and the shared tail would overflow the 16-bit next_off field in S_study_chunk() in regcomp.c; add a regression test in t/re/pat_advanced.t; backported from upstream commit 03f74bbbd3a68350d926ee93d56ee4808c28c4c7.
  • CVE-2026-13221
• SECURITY UPDATE: out-of-bounds heap read in pack/unpack
  • debian/patches/CVE-2026-57432.patch: croak when the computed structure size would overflow SSize_t and harden the B/b and H/h length calculations in S_measure_struct() in pp_pack.c; document the new diagnostic in pod/perldiag.pod; backported from upstream commits 5f7eb6bbbe0510964e3fb1d6bb691e5445913e55 and 40754edc72dd3e513d758153c0e2f0215897740e.
  • CVE-2026-57432

• CVE-2026-13221: regex trie construction in S_study_chunk stored the branch-to-tail delta in a 16-bit field; an alternation of more than 65535 fixed-string branches overflowed it and produced silently incorrect matches (GH#23388) — decline the trie optimization when the span would overflow
• CVE-2026-57432: integer overflow in S_measure_struct pack/unpack size calculation wrapped the signed total negative, letting the @, X and x position codes read out of bounds; croak on overflow and harden the B/b/H/h length math

• CVE-2026-13221: regex trie construction in S_study_chunk stored the branch-to-tail delta in a 16-bit field; an alternation of more than 65535 fixed-string branches overflowed it and produced silently incorrect matches (GH#23388) — decline the trie optimization when the span would overflow
• CVE-2026-57432: integer overflow in S_measure_struct pack/unpack size calculation wrapped the signed total negative, letting the @, X and x position codes read out of bounds; croak on overflow and harden the B/b/H/h length math

• CVE-2026-13221: regex trie 16-bit field overflow in Perl_study_chunk produces silently incorrect matches
• CVE-2026-57432: integer overflow in S_measure_struct leads to out-of-bounds heap read in pack/unpack

• CVE-2026-13221: do not build a regex trie when the branch-to-tail delta would overflow the 16-bit next-offset field, which could otherwise truncate the trie decision table (GH#23388)
• CVE-2026-57432: fix integer overflow in S_measure_struct when computing the size of a pack/unpack structure with a large repeat count, which could wrap the signed size negative and lead to an out-of-bounds heap read

• SECURITY UPDATE: regex trie 16-bit next-offset overflow (GH#23388)
  • debian/patches/CVE-2026-13221.patch: do not build a trie when the branch-to-tail delta would overflow the 16-bit next-offset field in S_study_chunk() in regcomp.c
  • CVE-2026-13221
• SECURITY UPDATE: integer overflow in pack/unpack structure sizing (S_measure_struct); a large repeat count wraps the signed size negative, leading to an out-of-bounds heap read
  • debian/patches/CVE-2026-57432.patch: integer overflow in pack/unpack structure sizing (S_measure_struct); a large repeat count wraps the signed size negative, leading to an out-of-bounds heap read
  • CVE-2026-57432

• SECURITY UPDATE: regex trie 16-bit next-offset overflow (GH#23388)
  • debian/patches/fixes/CVE-2026-13221.patch: do not build a trie when the branch-to-tail delta would overflow the 16-bit next-offset field in S_study_chunk() in regcomp.c
  • CVE-2026-13221
• SECURITY UPDATE: integer overflow in pack/unpack structure sizing
  • debian/patches/fixes/CVE-2026-57432.patch: add I32 overflow check before the size accumulation in S_measure_struct() in pp_pack.c
  • CVE-2026-57432

• CVE-2026-13221: do not build a regex trie when the branch-to-tail delta would overflow the 16-bit next-offset field, which could otherwise truncate the trie decision table (GH#23388)
• CVE-2026-57432: fix integer overflow in S_measure_struct when computing the size of a pack/unpack structure with a large repeat count, which could wrap the signed size negative and lead to an out-of-bounds heap read

• CVE-2026-13221: do not build a regex trie when the branch-to-tail delta would overflow the 16-bit next-offset field, which could otherwise truncate the trie decision table (GH#23388)
• CVE-2026-57432: fix integer overflow in S_measure_struct when computing the size of a pack/unpack structure with a large repeat count, which could wrap the signed size negative and lead to an out-of-bounds heap read

• Fix armel build under qemu-user emulation: skip process-title and threaded directory-handle tests that cannot pass under qemu-arm-static
  • debian/patches/debian/armel-skip-qemu-emulation-tests.diff: guard the argv[0]/$0 assertions in t/op/magic.t and dist/threads/t/join.t and the cloned-dir-iterator assertion in t/op/threads-dirh.t on the armel archname (arm-linux-gnueabi*), so amd64/arm64 keep running them

The updated Mageia 10 perl packages contain security fixes for CVE-2026-13221, CVE-2026-57432 and CVE-2026-57433. The Mageia 9 perl packages were not affected by CVE-2026-13221, they are now updated with fixes for CVE-2026-57432 and CVE-2026-57433.

This update for perl fixes the following issues:

• CVE-2025-15649: IO:Uncompress:Unzip propagates uncaught exception when parsing zip header with malformed DOS date (bsc#1266361).
• CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds (bsc#1266304).
• CVE-2026-12087: Socket's pack_ip_mreq_source() can copy adjacent heap memory into the returned packed structure (bsc#1268349).
• CVE-2026-57432: an integer overflow in S_measure_struct leads to an out-of-bounds heap read in pack and unpack (bsc#1271372).
• CVE-2026-13221: regex trie branch-count overflow leads to silent false-positive/negative pattern matching (bsc#1271386).

Root has patched CVE-2026-13221 in the perl package for Root:Alpine:3.22. Multiple fixed versions available.

Root has patched CVE-2026-13221 in the perl package for Root:Alpine:3.23. Multiple fixed versions available.

Root has patched CVE-2026-13221 in the perl package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-13221 in the perl package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-13221 in the perl package for Root:Debian:13. Multiple fixed versions available.

This update for perl fixes the following issues:

• CVE-2025-15649: IO:Uncompress:Unzip propagates uncaught exception when parsing zip header with malformed DOS date (bsc#1266361).
• CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds (bsc#1266304).
• CVE-2026-12087: Socket's pack_ip_mreq_source() can copy adjacent heap memory into the returned packed structure (bsc#1268349).
• CVE-2026-57432: an integer overflow in S_measure_struct leads to an out-of-bounds heap read in pack and unpack (bsc#1271372).
• CVE-2026-13221: regex trie branch-count overflow leads to silent false-positive/negative pattern matching (bsc#1271386).

This update for perl fixes the following issues:

• CVE-2025-15649: IO:Uncompress:Unzip propagates uncaught exception when parsing zip header with malformed DOS date (bsc#1266361).
• CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds (bsc#1266304).
• CVE-2026-12087: Socket's pack_ip_mreq_source() can copy adjacent heap memory into the returned packed structure (bsc#1268349).
• CVE-2026-57432: an integer overflow in S_measure_struct leads to an out-of-bounds heap read in pack and unpack (bsc#1271372).
• CVE-2026-13221: regex trie branch-count overflow leads to silent false-positive/negative pattern matching (bsc#1271386).

This update for perl fixes the following issues

• CVE-2025-15649: IO:Uncompress:Unzip propagates uncaught exception when parsing zip header with malformed DOS date (bsc#1266361).
• CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds (bsc#1266304).
• CVE-2026-12087: Socket's pack_ip_mreq_source() can copy adjacent heap memory into the returned packed structure (bsc#1268349).
• CVE-2026-57432: an integer overflow in S_measure_struct leads to an out-of-bounds heap read in pack and unpack (bsc#1271372).
• CVE-2026-13221: regex trie branch-count overflow leads to silent false-positive/negative pattern matching (bsc#1271386).

This update for perl fixes the following issues

• CVE-2025-15649: IO:Uncompress:Unzip propagates uncaught exception when parsing zip header with malformed DOS date (bsc#1266361).
• CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds (bsc#1266304).
• CVE-2026-12087: Socket's pack_ip_mreq_source() can copy adjacent heap memory into the returned packed structure (bsc#1268349).
• CVE-2026-57432: an integer overflow in S_measure_struct leads to an out-of-bounds heap read in pack and unpack (bsc#1271372).
• CVE-2026-13221: regex trie branch-count overflow leads to silent false-positive/negative pattern matching (bsc#1271386).

It was discovered that Perl incorrectly handled short source addresses in the Socket module. An attacker could possibly use this issue to trigger an out-of-bounds heap read, resulting in information disclosure. (CVE-2026-12087)

It was discovered that Perl incorrectly handled regular expressions containing a large number of fixed string alternatives. An attacker could possibly use this issue to cause incorrect regular expression matches, resulting in security restrictions being bypassed. (CVE-2026-13221)

It was discovered that Perl incorrectly handled certain large repeat counts when processing pack and unpack templates. An attacker could possibly use this issue to trigger an out-of-bounds heap read, resulting in information disclosure. (CVE-2026-57432)

It was discovered that Perl incorrectly handled certain crafted data when deserializing with the Storable module. An attacker could possibly use this issue to trigger an integer overflow and application termination, resulting in a denial of service. (CVE-2026-57433)

USN-8675-1 fixed vulnerabilities in Perl. This update provides the corresponding fix for Perl on Ubuntu 26.04 LTS.

Original advisory details:

It was discovered that Perl incorrectly handled short source addresses in the Socket module. An attacker could possibly use this issue to trigger an out-of-bounds heap read, resulting in information disclosure. (CVE-2026-12087)

It was discovered that Perl incorrectly handled regular expressions containing a large number of fixed string alternatives. An attacker could possibly use this issue to cause incorrect regular expression matches, resulting in security restrictions being bypassed. (CVE-2026-13221)

It was discovered that Perl incorrectly handled certain large repeat counts when processing pack and unpack templates. An attacker could possibly use this issue to trigger an out-of-bounds heap read, resulting in information disclosure. (CVE-2026-57432)

It was discovered that Perl incorrectly handled certain crafted data when deserializing with the Storable module. An attacker could possibly use this issue to trigger an integer overflow and application termination, resulting in a denial of service. (CVE-2026-57433)

It was discovered that Perl incorrectly handled certain arguments to Socket and pack/unpack functions. An attacker could possibly use this issue to read sensitive information from memory. (CVE-2026-12087, CVE-2026-57432)

It was discovered that Perl incorrectly handled regular expressions with a large number of alternation branches. An attacker could possibly use this issue to cause incorrect matching results. (CVE-2026-13221)

It was discovered that Perl incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-57433, CVE-2025-15649, CVE-2026-48959, CVE-2026-9538)

It was discovered that Perl incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-48962)

It was discovered that Perl incorrectly handled credential headers during cross-origin redirects in HTTP::Tiny. An attacker could possibly use this issue to expose sensitive information. (CVE-2026-7017)