CVE-2026-8376

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.

Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer.

A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.

Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects.

Security Fix(es):

Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.

Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer.

A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.(CVE-2026-8376)

Root has patched CVE-2026-8376 in the perl package for Root:Alpine:3.22. Multiple fixed versions available.

Root has patched CVE-2026-8376 in the perl package for Root:Alpine:3.23. Multiple fixed versions available.

Root has patched CVE-2026-8376 in the perl package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-8376 in the perl package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-8376 in the perl package for Root:Debian:13. Multiple fixed versions available.

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.

Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer.

A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.

• CVE-2026-8376: heap buffer overflow in regex compilation with repeated fixed string on 32-bit builds

• CVE-2026-8376: heap buffer overflow in regex compilation with repeated fixed string on 32-bit builds

• CVE-2026-8376: heap buffer overflow in regex compilation with repeated fixed string on 32-bit builds

• SECURITY UPDATE: heap buffer overflow in the regexp compiler (32-bit)
  • debian/patches/CVE-2026-8376.patch: guard against an SSize_t overflow when sizing the joined fixed-substring buffer in Perl_study_chunk() in regcomp.c; backported from upstream commit 5e7f119eb2bb1181be908701f22bf7068e722f1c.
  • CVE-2026-8376

• CVE-2026-8376: fix heap buffer overflow in S_study_chunk when compiling regular expressions with a repeated fixed string on 32-bit builds (mincount * l overflow)

• CVE-2026-8376: fix heap buffer overflow in S_study_chunk when compiling regular expressions with a repeated fixed string on 32-bit builds (mincount * l overflow)

• CVE-2026-8376: fix heap buffer overflow in S_study_chunk when compiling regular expressions with a repeated fixed string on 32-bit builds (mincount * l overflow)

• CVE-2026-8376: fix heap buffer overflow in S_study_chunk when compiling regular expressions with a repeated fixed string on 32-bit builds (mincount * l overflow)

• SECURITY UPDATE: heap buffer overflow in regex compilation (32-bit)
  • debian/patches/fixes/CVE-2026-8376.patch: add SSize_t overflow check before SvGROW in Perl_study_chunk()
  • CVE-2026-8376

• SECURITY UPDATE: heap buffer overflow in regex compilation with repeated fixed string on 32-bit builds
  • debian/patches/fixes/CVE-2026-8376.patch: add SSize_t overflow check before SvGROW in Perl_study_chunk()
  • CVE-2026-8376

• SECURITY UPDATE: heap buffer overflow in regex compilation (32-bit)
  • debian/patches/CVE-2026-8376.patch: add SSize_t overflow check before SvGROW in Perl_study_chunk()
  • CVE-2026-8376

• CVE-2026-8376: fix heap buffer overflow in S_study_chunk when compiling regular expressions with a repeated fixed string on 32-bit builds (mincount * l overflow)

• CVE-2026-8376: fix heap buffer overflow in S_study_chunk when compiling regular expressions with a repeated fixed string on 32-bit builds (mincount * l overflow)

• CVE-2026-8376: fix heap buffer overflow in S_study_chunk when compiling regular expressions with a repeated fixed string on 32-bit builds (mincount * l overflow)

Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. (CVE-2026-8376)

This update for perl fixes the following issues:

• CVE-2025-15649: IO:Uncompress:Unzip propagates uncaught exception when parsing zip header with malformed DOS date (bsc#1266361).
• CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds (bsc#1266304).
• CVE-2026-12087: Socket's pack_ip_mreq_source() can copy adjacent heap memory into the returned packed structure (bsc#1268349).
• CVE-2026-57432: an integer overflow in S_measure_struct leads to an out-of-bounds heap read in pack and unpack (bsc#1271372).
• CVE-2026-13221: regex trie branch-count overflow leads to silent false-positive/negative pattern matching (bsc#1271386).

This update for perl fixes the following issues:

• CVE-2025-15649: IO:Uncompress:Unzip propagates uncaught exception when parsing zip header with malformed DOS date (bsc#1266361).
• CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds (bsc#1266304).
• CVE-2026-12087: Socket's pack_ip_mreq_source() can copy adjacent heap memory into the returned packed structure (bsc#1268349).
• CVE-2026-57432: an integer overflow in S_measure_struct leads to an out-of-bounds heap read in pack and unpack (bsc#1271372).
• CVE-2026-13221: regex trie branch-count overflow leads to silent false-positive/negative pattern matching (bsc#1271386).

This update for perl fixes the following issues:

• CVE-2025-15649: IO:Uncompress:Unzip propagates uncaught exception when parsing zip header with malformed DOS date (bsc#1266361).
• CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds (bsc#1266304).
• CVE-2026-12087: Socket's pack_ip_mreq_source() can copy adjacent heap memory into the returned packed structure (bsc#1268349).
• CVE-2026-57432: an integer overflow in S_measure_struct leads to an out-of-bounds heap read in pack and unpack (bsc#1271372).
• CVE-2026-13221: regex trie branch-count overflow leads to silent false-positive/negative pattern matching (bsc#1271386).

This update for perl fixes the following issues

• CVE-2025-15649: IO:Uncompress:Unzip propagates uncaught exception when parsing zip header with malformed DOS date (bsc#1266361).
• CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds (bsc#1266304).
• CVE-2026-12087: Socket's pack_ip_mreq_source() can copy adjacent heap memory into the returned packed structure (bsc#1268349).
• CVE-2026-57432: an integer overflow in S_measure_struct leads to an out-of-bounds heap read in pack and unpack (bsc#1271372).
• CVE-2026-13221: regex trie branch-count overflow leads to silent false-positive/negative pattern matching (bsc#1271386).

This update for perl fixes the following issues

• CVE-2025-15649: IO:Uncompress:Unzip propagates uncaught exception when parsing zip header with malformed DOS date (bsc#1266361).
• CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds (bsc#1266304).
• CVE-2026-12087: Socket's pack_ip_mreq_source() can copy adjacent heap memory into the returned packed structure (bsc#1268349).
• CVE-2026-57432: an integer overflow in S_measure_struct leads to an out-of-bounds heap read in pack and unpack (bsc#1271372).
• CVE-2026-13221: regex trie branch-count overflow leads to silent false-positive/negative pattern matching (bsc#1271386).

This update for perl fixes the following issues:

• CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds (bsc#1266304).
• CVE-2026-12087: Socket's pack_ip_mreq_source() can copy adjacent heap memory into the returned packed structure (bsc#1268349).
• CVE-2026-57432: an integer overflow in S_measure_struct leads to an out-of-bounds heap read in pack and unpack (bsc#1271372).

This update for perl fixes the following issues:

• CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds (bsc#1266304).
• CVE-2026-12087: Socket's pack_ip_mreq_source() can copy adjacent heap memory into the returned packed structure (bsc#1268349).
• CVE-2026-57432: an integer overflow in S_measure_struct leads to an out-of-bounds heap read in pack and unpack (bsc#1271372).

It was discovered that Perl's Archive::Tar module incorrectly handled symlink and hardlink targets during extraction. An attacker could use this issue to read or overwrite arbitrary files outside the extraction directory. (CVE-2026-42496)

It was discovered that Perl had a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. An attacker could use this issue to cause a denial of service or possibly execute arbitrary code. (CVE-2026-8376)

USN-8467-1 fixed vulnerabilities in Perl. This update provides the corresponding fix for Perl on Ubuntu 25.10.

Original advisory details: It was discovered that Perl's Archive::Tar module incorrectly handled symlink and hardlink targets during extraction. An attacker could use this issue to read or overwrite arbitrary files outside the extraction directory. (CVE-2026-42496) It was discovered that Perl had a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. An attacker could use this issue to cause a denial of service or possibly execute arbitrary code. (CVE-2026-8376)