CVE-2009-3626
Perl 5.10.1 allows context-dependent attackers to cause a denial of service (application crash)...
Perl 5.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a UTF-8 character with a large, invalid codepoint, which is not properly handled during a regular-expression match.
Exploit likelihood
What each source reports
NVD Score used
Perl 5.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a UTF-8 character with a large, invalid codepoint, which is not properly handled during a regular-expression match.
- Record
CVE-2009-3626- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
Perl 5.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a UTF-8 character with a large, invalid codepoint, which is not properly handled during a regular-expression match.
- Record
CVE-2009-3626- Updated
- 2026-11-02
EUVDEUVD-2009-3607 No score
Perl 5.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a UTF-8 character with a large, invalid codepoint, which is not properly handled during a regular-expression match.
- Record
EUVD-2009-3607- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pr3m-646v-qvfc No score
Perl 5.10.1 allows context-dependent attackers to cause a denial of service (application crash)...
Perl 5.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a UTF-8 character with a large, invalid codepoint, which is not properly handled during a regular-expression match.
- Record
GHSA-pr3m-646v-qvfc- Updated
- 2026-11-02
OSV No score
Perl 5.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a UTF-8 character with a large, invalid codepoint, which is not properly handled during a regular-expression match.
- Record
CVE-2009-3626- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-3626 No score
Perl 5.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a UTF-8 character with a large, invalid codepoint, which is not properly handled during a regular-expression match.
- Record
DEBIAN-CVE-2009-3626- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-3626 is a medium vulnerability (CVSS 5.0) in Perl, published October 29, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.19%, the 82nd percentile. Fixed in perl 5.10.1-6.
References
vupen.com/english/advisories/2009/3023
openwall.com/lists/oss-security/2009/10/23/8
osvdb.org/59283
exchange.xforce.ibmcloud.com/vulnerabilities/53939
rt.perl.org/rt3/Ticket/Attachment/617489/295383
issues.apache.org/SpamAssassin/show_bug.cgi?id=6225
Show 8 moreShow less
secunia.com/advisories/37144
perl5.git.perl.org/perl.git/commit/0abd0d78a73da1c4d13b1c700526b7e5d03b32d4
securityfocus.com/bid/36812
securitytracker.com/id?1023077
nvd.nist.gov/vuln/detail/CVE-2009-3626
github.com/advisories/GHSA-pr3m-646v-qvfc
security-tracker.debian.org/tracker/CVE-2009-3626