Every CVE Search/ Get API key

CVE-2026-77781

Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys

7.5 HighFix available

Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys.

The FETCH, EXISTS and DELETE methods throw an exception when on malformed regular expressions.

Each method falls back to a regex match when the key is not already stored in the hash, compiling the caller's key with a bare qr// and no eval guard. A key that is not a valid regular expression pattern, such as a single unmatched bracket, dies.

An application that looks up externally supplied strings in a tied hash will die on an invalid key.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.61%Up 0.4 points since Aug 22, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys

Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys.

The FETCH, EXISTS and DELETE methods throw an exception when on malformed regular expressions.

Each method falls back to a regex match when the key is not already stored in the hash, compiling the caller's key with a bare qr// and no eval guard. A key that is not a valid regular expression pattern, such as a single unmatched bracket, dies.

An application that looks up externally supplied strings in a tied hash will die on an invalid key.

Record
CVE-2026-77781
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-248
Updated
2026-11-02
EUVDEUVD-2026-64205 7.5

Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys.

The FETCH, EXISTS and DELETE methods throw an exception when on malformed regular expressions.

Each method falls back to a regex match when the key is not already stored in the hash, compiling the caller's key with a bare qr// and no eval guard. A key that is not a valid regular expression pattern, such as a single unmatched bracket, dies.

An application that looks up externally supplied strings in a tied hash will die on an invalid key.

Record
EUVD-2026-64205
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-fwmp-gxj5-29mj 7.5

Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup...

Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys.

The FETCH, EXISTS and DELETE methods throw an exception when on malformed regular expressions.

Each method falls back to a regex match when the key is not already stored in the hash, compiling the caller's key with a bare qr// and no eval guard. A key that is not a valid regular expression pattern, such as a single unmatched bracket, dies.

An application that looks up externally supplied strings in a tied hash will die on an invalid key.

Record
GHSA-fwmp-gxj5-29mj
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-248
Updated
2026-11-02
NVD 7.5

Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys.

The FETCH, EXISTS and DELETE methods throw an exception when on malformed regular expressions.

Each method falls back to a regex match when the key is not already stored in the hash, compiling the caller's key with a bare qr// and no eval guard. A key that is not a valid regular expression pattern, such as a single unmatched bracket, dies.

An application that looks up externally supplied strings in a tied hash will die on an invalid key.

Record
CVE-2026-77781
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-248
Updated
2026-11-02
OSV 7.5

Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys

Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys.

The FETCH, EXISTS and DELETE methods throw an exception when on malformed regular expressions.

Each method falls back to a regex match when the key is not already stored in the hash, compiling the caller's key with a bare qr// and no eval guard. A key that is not a valid regular expression pattern, such as a single unmatched bracket, dies.

An application that looks up externally supplied strings in a tied hash will die on an invalid key.

Record
CVE-2026-77781
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-248
Updated
2026-11-02
OSVDEBIAN-CVE-2026-77781 7.5

Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys. The FETCH, EXISTS and DELETE methods throw an exception when on malformed regular expressions. Each method falls back to a regex match when the key is not already stored in the hash, compiling the caller's key with a bare qr// and no eval guard. A key that is not a valid regular expression pattern, such as a single unmatched bracket, dies. An application that looks up externally supplied strings in a tied hash will die on an invalid key.

Record
DEBIAN-CVE-2026-77781
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-77781 7.5

Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys. The FETCH, EXISTS and DELETE methods throw an exception when on malformed regular expressions. Each method falls back to a regex match when the key is not already stored in the hash, compiling the caller's key with a bare qr// and no eval guard. A key that is not a valid regular expression pattern, such as a single unmatched bracket, dies. An application that looks up externally supplied strings in a tied hash will die on an invalid key.

Record
UBUNTU-CVE-2026-77781
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
libtie-hash-regex-perl
Debian:12
All versions, plus listed versions
1.14-21.14-3
None known
libtie-hash-regex-perl
Debian:13
All versions, plus listed versions
1.14-21.14-3
None known
libtie-hash-regex-perl
Debian:14
before 1.14-3, plus listed versions
1.14-2
1.14-3
libtie-hash-regex-perl
Ubuntu:16.04:LTS
All versions, plus listed versions
1.02-2
None known
libtie-hash-regex-perl
Ubuntu:18.04:LTS
All versions, plus listed versions
1.02-2
None known
libtie-hash-regex-perl
Ubuntu:20.04:LTS
All versions, plus listed versions
1.12-1
None known
libtie-hash-regex-perl
Ubuntu:22.04:LTS
All versions, plus listed versions
1.14-1
None known
libtie-hash-regex-perl
Ubuntu:24.04:LTS
All versions, plus listed versions
1.14-2
None known
libtie-hash-regex-perl
Ubuntu:26.10
All versions, plus listed versions
1.14-2
None known
libtie-hash-regex-perl
Ubuntu:26.04:LTS
All versions, plus listed versions
1.14-2
None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-77781 is a high vulnerability (CVSS 7.5) in libtie-hash-regex-perl, published August 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.61%, the 49th percentile. Fixed in libtie-hash-regex-perl 1.14-3.

References

Show 6 moreShow less
MoveEnter Open