CVE-2026-57432

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.

Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects.

Security Fix(es):

Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.

S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.

A template derived from untrusted input can read heap memory past the buffer and return it to the caller.(CVE-2026-57432)

Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.

retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.

A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.(CVE-2026-57433)

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.

S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.

A template derived from untrusted input can read heap memory past the buffer and return it to the caller.

• CVE-2026-13221: regex trie 16-bit field overflow in Perl_study_chunk produces silently incorrect matches
• CVE-2026-57432: integer overflow in S_measure_struct leads to out-of-bounds heap read in pack/unpack

• CVE-2026-13221: regex trie 16-bit field overflow in Perl_study_chunk produces silently incorrect matches
• CVE-2026-57432: integer overflow in S_measure_struct leads to out-of-bounds heap read in pack/unpack

• SECURITY UPDATE: silently incorrect regular expression matches from oversized tries
  • debian/patches/CVE-2026-13221.patch: skip building a trie when the delta between the first branch and the shared tail would overflow the 16-bit next_off field in S_study_chunk() in regcomp.c; add a regression test in t/re/pat_advanced.t; backported from upstream commit 03f74bbbd3a68350d926ee93d56ee4808c28c4c7.
  • CVE-2026-13221
• SECURITY UPDATE: out-of-bounds heap read in pack/unpack
  • debian/patches/CVE-2026-57432.patch: croak when the computed structure size would overflow SSize_t and harden the B/b and H/h length calculations in S_measure_struct() in pp_pack.c; document the new diagnostic in pod/perldiag.pod; backported from upstream commits 5f7eb6bbbe0510964e3fb1d6bb691e5445913e55 and 40754edc72dd3e513d758153c0e2f0215897740e.
  • CVE-2026-57432

• CVE-2026-13221: regex trie construction in S_study_chunk stored the branch-to-tail delta in a 16-bit field; an alternation of more than 65535 fixed-string branches overflowed it and produced silently incorrect matches (GH#23388) — decline the trie optimization when the span would overflow
• CVE-2026-57432: integer overflow in S_measure_struct pack/unpack size calculation wrapped the signed total negative, letting the @, X and x position codes read out of bounds; croak on overflow and harden the B/b/H/h length math

• CVE-2026-13221: regex trie construction in S_study_chunk stored the branch-to-tail delta in a 16-bit field; an alternation of more than 65535 fixed-string branches overflowed it and produced silently incorrect matches (GH#23388) — decline the trie optimization when the span would overflow
• CVE-2026-57432: integer overflow in S_measure_struct pack/unpack size calculation wrapped the signed total negative, letting the @, X and x position codes read out of bounds; croak on overflow and harden the B/b/H/h length math

• CVE-2026-13221: regex trie 16-bit field overflow in Perl_study_chunk produces silently incorrect matches
• CVE-2026-57432: integer overflow in S_measure_struct leads to out-of-bounds heap read in pack/unpack

• CVE-2026-13221: do not build a regex trie when the branch-to-tail delta would overflow the 16-bit next-offset field, which could otherwise truncate the trie decision table (GH#23388)
• CVE-2026-57432: fix integer overflow in S_measure_struct when computing the size of a pack/unpack structure with a large repeat count, which could wrap the signed size negative and lead to an out-of-bounds heap read

• SECURITY UPDATE: regex trie 16-bit next-offset overflow (GH#23388)
  • debian/patches/CVE-2026-13221.patch: do not build a trie when the branch-to-tail delta would overflow the 16-bit next-offset field in S_study_chunk() in regcomp.c
  • CVE-2026-13221
• SECURITY UPDATE: integer overflow in pack/unpack structure sizing (S_measure_struct); a large repeat count wraps the signed size negative, leading to an out-of-bounds heap read
  • debian/patches/CVE-2026-57432.patch: integer overflow in pack/unpack structure sizing (S_measure_struct); a large repeat count wraps the signed size negative, leading to an out-of-bounds heap read
  • CVE-2026-57432

• SECURITY UPDATE: regex trie 16-bit next-offset overflow (GH#23388)
  • debian/patches/fixes/CVE-2026-13221.patch: do not build a trie when the branch-to-tail delta would overflow the 16-bit next-offset field in S_study_chunk() in regcomp.c
  • CVE-2026-13221
• SECURITY UPDATE: integer overflow in pack/unpack structure sizing
  • debian/patches/fixes/CVE-2026-57432.patch: add I32 overflow check before the size accumulation in S_measure_struct() in pp_pack.c
  • CVE-2026-57432

• CVE-2026-13221: do not build a regex trie when the branch-to-tail delta would overflow the 16-bit next-offset field, which could otherwise truncate the trie decision table (GH#23388)
• CVE-2026-57432: fix integer overflow in S_measure_struct when computing the size of a pack/unpack structure with a large repeat count, which could wrap the signed size negative and lead to an out-of-bounds heap read

• CVE-2026-13221: do not build a regex trie when the branch-to-tail delta would overflow the 16-bit next-offset field, which could otherwise truncate the trie decision table (GH#23388)
• CVE-2026-57432: fix integer overflow in S_measure_struct when computing the size of a pack/unpack structure with a large repeat count, which could wrap the signed size negative and lead to an out-of-bounds heap read

• CVE-2026-57432: fix pack/unpack SSize_t overflow when computing structure size

• Fix armel build under qemu-user emulation: skip process-title and threaded directory-handle tests that cannot pass under qemu-arm-static
  • debian/patches/debian/armel-skip-qemu-emulation-tests.diff: guard the argv[0]/$0 assertions in t/op/magic.t and dist/threads/t/join.t and the cloned-dir-iterator assertion in t/op/threads-dirh.t on the armel archname (arm-linux-gnueabi*), so amd64/arm64 keep running them

• CVE-2026-57432: fix pack/unpack SSize_t overflow when computing structure size

The updated Mageia 10 perl packages contain security fixes for CVE-2026-13221, CVE-2026-57432 and CVE-2026-57433. The Mageia 9 perl packages were not affected by CVE-2026-13221, they are now updated with fixes for CVE-2026-57432 and CVE-2026-57433.

This update for perl fixes the following issues:

• CVE-2025-15649: IO:Uncompress:Unzip propagates uncaught exception when parsing zip header with malformed DOS date (bsc#1266361).
• CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds (bsc#1266304).
• CVE-2026-12087: Socket's pack_ip_mreq_source() can copy adjacent heap memory into the returned packed structure (bsc#1268349).
• CVE-2026-57432: an integer overflow in S_measure_struct leads to an out-of-bounds heap read in pack and unpack (bsc#1271372).
• CVE-2026-13221: regex trie branch-count overflow leads to silent false-positive/negative pattern matching (bsc#1271386).

Root has patched CVE-2026-57432 in the perl package for Root:Alpine:3.22. Multiple fixed versions available.

Root has patched CVE-2026-57432 in the perl package for Root:Alpine:3.23. Multiple fixed versions available.

Root has patched CVE-2026-57432 in the perl package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-57432 in the perl package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-57432 in the perl package for Root:Debian:13. Multiple fixed versions available.

This update for perl fixes the following issues:

• CVE-2025-15649: IO:Uncompress:Unzip propagates uncaught exception when parsing zip header with malformed DOS date (bsc#1266361).
• CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds (bsc#1266304).
• CVE-2026-12087: Socket's pack_ip_mreq_source() can copy adjacent heap memory into the returned packed structure (bsc#1268349).
• CVE-2026-57432: an integer overflow in S_measure_struct leads to an out-of-bounds heap read in pack and unpack (bsc#1271372).
• CVE-2026-13221: regex trie branch-count overflow leads to silent false-positive/negative pattern matching (bsc#1271386).

This update for perl fixes the following issues:

• CVE-2025-15649: IO:Uncompress:Unzip propagates uncaught exception when parsing zip header with malformed DOS date (bsc#1266361).
• CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds (bsc#1266304).
• CVE-2026-12087: Socket's pack_ip_mreq_source() can copy adjacent heap memory into the returned packed structure (bsc#1268349).
• CVE-2026-57432: an integer overflow in S_measure_struct leads to an out-of-bounds heap read in pack and unpack (bsc#1271372).
• CVE-2026-13221: regex trie branch-count overflow leads to silent false-positive/negative pattern matching (bsc#1271386).

This update for perl fixes the following issues

• CVE-2025-15649: IO:Uncompress:Unzip propagates uncaught exception when parsing zip header with malformed DOS date (bsc#1266361).
• CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds (bsc#1266304).
• CVE-2026-12087: Socket's pack_ip_mreq_source() can copy adjacent heap memory into the returned packed structure (bsc#1268349).
• CVE-2026-57432: an integer overflow in S_measure_struct leads to an out-of-bounds heap read in pack and unpack (bsc#1271372).
• CVE-2026-13221: regex trie branch-count overflow leads to silent false-positive/negative pattern matching (bsc#1271386).

This update for perl fixes the following issues

• CVE-2025-15649: IO:Uncompress:Unzip propagates uncaught exception when parsing zip header with malformed DOS date (bsc#1266361).
• CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds (bsc#1266304).
• CVE-2026-12087: Socket's pack_ip_mreq_source() can copy adjacent heap memory into the returned packed structure (bsc#1268349).
• CVE-2026-57432: an integer overflow in S_measure_struct leads to an out-of-bounds heap read in pack and unpack (bsc#1271372).
• CVE-2026-13221: regex trie branch-count overflow leads to silent false-positive/negative pattern matching (bsc#1271386).

This update for perl fixes the following issues:

• CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds (bsc#1266304).
• CVE-2026-12087: Socket's pack_ip_mreq_source() can copy adjacent heap memory into the returned packed structure (bsc#1268349).
• CVE-2026-57432: an integer overflow in S_measure_struct leads to an out-of-bounds heap read in pack and unpack (bsc#1271372).

This update for perl fixes the following issues:

• CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds (bsc#1266304).
• CVE-2026-12087: Socket's pack_ip_mreq_source() can copy adjacent heap memory into the returned packed structure (bsc#1268349).
• CVE-2026-57432: an integer overflow in S_measure_struct leads to an out-of-bounds heap read in pack and unpack (bsc#1271372).

It was discovered that Perl incorrectly handled short source addresses in the Socket module. An attacker could possibly use this issue to trigger an out-of-bounds heap read, resulting in information disclosure. (CVE-2026-12087)

It was discovered that Perl incorrectly handled regular expressions containing a large number of fixed string alternatives. An attacker could possibly use this issue to cause incorrect regular expression matches, resulting in security restrictions being bypassed. (CVE-2026-13221)

It was discovered that Perl incorrectly handled certain large repeat counts when processing pack and unpack templates. An attacker could possibly use this issue to trigger an out-of-bounds heap read, resulting in information disclosure. (CVE-2026-57432)

It was discovered that Perl incorrectly handled certain crafted data when deserializing with the Storable module. An attacker could possibly use this issue to trigger an integer overflow and application termination, resulting in a denial of service. (CVE-2026-57433)

USN-8675-1 fixed vulnerabilities in Perl. This update provides the corresponding fix for Perl on Ubuntu 26.04 LTS.

Original advisory details:

It was discovered that Perl incorrectly handled short source addresses in the Socket module. An attacker could possibly use this issue to trigger an out-of-bounds heap read, resulting in information disclosure. (CVE-2026-12087)

It was discovered that Perl incorrectly handled regular expressions containing a large number of fixed string alternatives. An attacker could possibly use this issue to cause incorrect regular expression matches, resulting in security restrictions being bypassed. (CVE-2026-13221)

It was discovered that Perl incorrectly handled certain large repeat counts when processing pack and unpack templates. An attacker could possibly use this issue to trigger an out-of-bounds heap read, resulting in information disclosure. (CVE-2026-57432)

It was discovered that Perl incorrectly handled certain crafted data when deserializing with the Storable module. An attacker could possibly use this issue to trigger an integer overflow and application termination, resulting in a denial of service. (CVE-2026-57433)

It was discovered that Perl incorrectly handled certain arguments to Socket and pack/unpack functions. An attacker could possibly use this issue to read sensitive information from memory. (CVE-2026-12087, CVE-2026-57432)

It was discovered that Perl incorrectly handled regular expressions with a large number of alternation branches. An attacker could possibly use this issue to cause incorrect matching results. (CVE-2026-13221)

It was discovered that Perl incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-57433, CVE-2025-15649, CVE-2026-48959, CVE-2026-9538)

It was discovered that Perl incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code. (CVE-2026-48962)

It was discovered that Perl incorrectly handled credential headers during cross-origin redirects in HTTP::Tiny. An attacker could possibly use this issue to expose sensitive information. (CVE-2026-7017)