{"id":"CVE-2026-12087","aliases":["ALPINE-CVE-2026-12087","AZL-90156","DEBIAN-CVE-2026-12087","EUVD-2026-37009","GHSA-q5cv-5vf6-95gp","MGASA-2026-0251","OESA-2026-2843","OESA-2026-2844","OESA-2026-2845","OESA-2026-2846","RHSA-2026:11342","ROOT-OS-DEBIAN-11-CVE-2026-12087","ROOT-OS-DEBIAN-12-CVE-2026-12087","ROOT-OS-DEBIAN-13-CVE-2026-12087","SUSE-SU-2026:22847-1","SUSE-SU-2026:22929-1","SUSE-SU-2026:23008-1","SUSE-SU-2026:23075-1","SUSE-SU-2026:3540-1","SUSE-SU-2026:3558-1","UBUNTU-CVE-2026-12087","USN-8675-1","USN-8675-2","USN-8684-1","openSUSE-SU-2026:21411-1"],"status":"published","title":"Socket versions before 2.041 for Perl have an out-of-bounds heap read","description":"Socket versions before 2.041 for Perl have an out-of-bounds heap read.\n\nIn Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.\n\nCalling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00594,"percentile":0.48878,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-125","CWE-805"],"published":"2026-06-15T21:11:09Z","modified":"2026-11-11T02:48:54Z","exploits":[{"source":"pocgithub","id":"gduma-phData/patch-CVE-2026-12087","title":"gduma-phData/patch-CVE-2026-12087","date":"2026-08-24","url":"https://github.com/gduma-phData/patch-CVE-2026-12087"}],"fixes":[{"ecosystem":"Alpine:v3.24","package":"perl","fixed_in":["5.42.3-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"perl","fixed_in":["5.38.2-512"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libsocket-perl","fixed_in":["2.038-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libsocket-perl","fixed_in":["2.041-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"perl","fixed_in":["5.36.0-7+deb12u4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"perl","fixed_in":["5.40.1-6+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"perl","fixed_in":["5.42.3-1"],"sources":["osv"]},{"ecosystem":"Mageia:10","package":"perl-Socket","fixed_in":["2.41.0-1.mga10"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"perl-Socket","fixed_in":["2.36.0-1.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"perl","fixed_in":["5.34.0-16.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"perl","fixed_in":["5.38.0-13.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"perl","fixed_in":["5.38.0-13.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"perl","fixed_in":["5.28.3-13.oe2003sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"perl-Socket","fixed_in":["0:2.041-1.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"perl-Socket-tests","fixed_in":["0:2.041-1.hum1"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"perl","fixed_in":["5.32.1-4+deb11u5.aikido.6","5.32.1-4+deb11u5.aikido.7","5.32.1-4+deb11u5.aikido.8","5.32.1-4+deb11u5.aikido.9","5.32.1-4+deb11u5.aikido.10","5.32.1-4+deb11u5.aikido.11","5.32.1-4+deb11u5.aikido.12","5.32.1-4+deb11u5.root.io.5"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-perl","fixed_in":["5.32.1-4+deb11u5.aikido.6","5.32.1-4+deb11u5.aikido.7","5.32.1-4+deb11u5.aikido.8","5.32.1-4+deb11u5.aikido.9","5.32.1-4+deb11u5.aikido.10","5.32.1-4+deb11u5.aikido.11","5.32.1-4+deb11u5.aikido.12","5.32.1-4+deb11u5.root.io.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"perl","fixed_in":["5.18.2-2ubuntu1.7+esm8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"perl","fixed_in":["5.22.1-9ubuntu0.9+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"perl","fixed_in":["5.26.1-6ubuntu0.7+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"perl","fixed_in":["5.30.0-9ubuntu0.5+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"perl","fixed_in":["5.34.0-3ubuntu1.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"perl","fixed_in":["5.38.2-3.2ubuntu0.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"perl","fixed_in":["5.40.1-7ubuntu0.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.42.3-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.38.2-512"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libsocket-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.036-1","2.037-1","2.038-1","2.040-1","2.041-1","2.043-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libsocket-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.038-1+deb13u1"}]}],"versions":["2.038-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libsocket-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.041-1"}]}],"versions":["2.038-1","2.040-1"]},{"source":"osv","ecosystem":"Debian:12","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.36.0-7+deb12u4"}]}],"versions":["5.36.0-7","5.36.0-7+deb12u1","5.36.0-7+deb12u2","5.36.0-7+deb12u3"]},{"source":"osv","ecosystem":"Debian:13","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.40.1-6+deb13u1"}]}],"versions":["5.40.1-6"]},{"source":"osv","ecosystem":"Debian:14","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.42.3-1"}]}],"versions":["5.40.1-6","5.40.1-7","5.40.1-8","5.42.0-1","5.42.0-2","5.42.0-3","5.42.2-1","5.42.2-2","5.42.2-3"]},{"source":"osv","ecosystem":"Mageia:10","package":"perl-Socket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41.0-1.mga10"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"perl-Socket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.36.0-1.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.34.0-16.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.38.0-13.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.38.0-13.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.28.3-13.oe2003sp4"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"perl-Socket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.041-1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"perl-Socket-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.041-1.hum1"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.32.1-4+deb11u5.aikido.6"},{"fixed":"5.32.1-4+deb11u5.aikido.7"},{"fixed":"5.32.1-4+deb11u5.aikido.8"},{"fixed":"5.32.1-4+deb11u5.aikido.9"},{"fixed":"5.32.1-4+deb11u5.aikido.10"},{"fixed":"5.32.1-4+deb11u5.aikido.11"},{"fixed":"5.32.1-4+deb11u5.aikido.12"},{"fixed":"5.32.1-4+deb11u5.root.io.5"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.32.1-4+deb11u5.aikido.6"},{"fixed":"5.32.1-4+deb11u5.aikido.7"},{"fixed":"5.32.1-4+deb11u5.aikido.8"},{"fixed":"5.32.1-4+deb11u5.aikido.9"},{"fixed":"5.32.1-4+deb11u5.aikido.10"},{"fixed":"5.32.1-4+deb11u5.aikido.11"},{"fixed":"5.32.1-4+deb11u5.aikido.12"},{"fixed":"5.32.1-4+deb11u5.root.io.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.42.0-160000.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.42.0-160000.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.42.0-160000.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.38.2-5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.38.2-slfo.1.1_3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.2-12.35.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.2-12.35.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-150300.17.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-150300.17.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-150300.17.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-150300.17.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-150300.17.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-150300.17.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-150300.17.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-150300.17.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-150300.17.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-150300.17.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-150300.17.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-150300.17.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-150300.17.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-150300.17.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-150300.17.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-150300.17.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.2-2ubuntu1.7+esm8"}]}],"versions":["5.14.2-21build1","5.18.1-4","5.18.1-4build1","5.18.1-5","5.18.2-2","5.18.2-2ubuntu1","5.18.2-2ubuntu1.1","5.18.2-2ubuntu1.3","5.18.2-2ubuntu1.4","5.18.2-2ubuntu1.6","5.18.2-2ubuntu1.7","5.18.2-2ubuntu1.7+esm3","5.18.2-2ubuntu1.7+esm4","5.18.2-2ubuntu1.7+esm5","5.18.2-2ubuntu1.7+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.22.1-9ubuntu0.9+esm3"}]}],"versions":["5.20.2-6","5.22.1-3","5.22.1-4","5.22.1-5","5.22.1-7","5.22.1-8","5.22.1-9","5.22.1-9ubuntu0.2","5.22.1-9ubuntu0.3","5.22.1-9ubuntu0.5","5.22.1-9ubuntu0.6","5.22.1-9ubuntu0.9","5.22.1-9ubuntu0.9+esm1","5.22.1-9ubuntu0.9+esm2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libsocket-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.020-1","2.021-1","2.021-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-6ubuntu0.7+esm3"}]}],"versions":["5.26.0-8ubuntu1","5.26.1-2ubuntu1","5.26.1-3","5.26.1-4","5.26.1-4build1","5.26.1-5","5.26.1-6","5.26.1-6ubuntu0.1","5.26.1-6ubuntu0.2","5.26.1-6ubuntu0.3","5.26.1-6ubuntu0.5","5.26.1-6ubuntu0.6","5.26.1-6ubuntu0.7","5.26.1-6ubuntu0.7+esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libsocket-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.024-1build2","2.027-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.30.0-9ubuntu0.5+esm3"}]}],"versions":["5.28.1-6build1","5.30.0-7","5.30.0-9","5.30.0-9build1","5.30.0-9ubuntu0.2","5.30.0-9ubuntu0.3","5.30.0-9ubuntu0.4","5.30.0-9ubuntu0.5","5.30.0-9ubuntu0.5+esm2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libsocket-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.029-1","2.029-1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libsocket-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.031-1","2.032-1","2.032-1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.34.0-3ubuntu1.8"}]}],"versions":["5.32.1-3ubuntu3","5.34.0-3ubuntu1","5.34.0-3ubuntu1.1","5.34.0-3ubuntu1.2","5.34.0-3ubuntu1.3","5.34.0-3ubuntu1.4","5.34.0-3ubuntu1.5","5.34.0-3ubuntu1.7"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libsocket-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.037-1","2.037-1build1","2.037-1build2","2.037-1build3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.38.2-3.2ubuntu0.4"}]}],"versions":["5.36.0-9ubuntu1","5.36.0-10ubuntu1","5.38.2-3","5.38.2-3.2","5.38.2-3.2build1","5.38.2-3.2build2","5.38.2-3.2build2.1","5.38.2-3.2ubuntu0.1","5.38.2-3.2ubuntu0.2","5.38.2-3.2ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libsocket-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.038-1build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.40.1-2","5.40.1-3","5.40.1-5","5.40.1-6","5.40.1-6build1","5.40.1-6ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libsocket-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.040-1","2.041-1","2.041-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libsocket-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.038-1build1","2.040-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.40.1-7ubuntu0.3"}]}],"versions":["5.40.1-6build1","5.40.1-7build1","5.40.1-7ubuntu0.1","5.40.1-7ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.2-2ubuntu1.7+esm8"}]}],"versions":["5.14.2-21build1","5.18.1-4","5.18.1-4build1","5.18.1-5","5.18.2-2","5.18.2-2ubuntu1","5.18.2-2ubuntu1.1","5.18.2-2ubuntu1.3","5.18.2-2ubuntu1.4","5.18.2-2ubuntu1.6","5.18.2-2ubuntu1.7","5.18.2-2ubuntu1.7+esm3","5.18.2-2ubuntu1.7+esm4","5.18.2-2ubuntu1.7+esm5","5.18.2-2ubuntu1.7+esm7"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.22.1-9ubuntu0.9+esm3"}]}],"versions":["5.20.2-6","5.22.1-3","5.22.1-4","5.22.1-5","5.22.1-7","5.22.1-8","5.22.1-9","5.22.1-9ubuntu0.2","5.22.1-9ubuntu0.3","5.22.1-9ubuntu0.5","5.22.1-9ubuntu0.6","5.22.1-9ubuntu0.9","5.22.1-9ubuntu0.9+esm1","5.22.1-9ubuntu0.9+esm2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-6ubuntu0.7+esm3"}]}],"versions":["5.26.0-8ubuntu1","5.26.1-2ubuntu1","5.26.1-3","5.26.1-4","5.26.1-4build1","5.26.1-5","5.26.1-6","5.26.1-6ubuntu0.1","5.26.1-6ubuntu0.2","5.26.1-6ubuntu0.3","5.26.1-6ubuntu0.5","5.26.1-6ubuntu0.6","5.26.1-6ubuntu0.7","5.26.1-6ubuntu0.7+esm2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.30.0-9ubuntu0.5+esm3"}]}],"versions":["5.28.1-6build1","5.30.0-7","5.30.0-9","5.30.0-9build1","5.30.0-9ubuntu0.2","5.30.0-9ubuntu0.3","5.30.0-9ubuntu0.4","5.30.0-9ubuntu0.5","5.30.0-9ubuntu0.5+esm2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.34.0-3ubuntu1.8"}]}],"versions":["5.32.1-3ubuntu3","5.34.0-3ubuntu1","5.34.0-3ubuntu1.1","5.34.0-3ubuntu1.2","5.34.0-3ubuntu1.3","5.34.0-3ubuntu1.4","5.34.0-3ubuntu1.5","5.34.0-3ubuntu1.7"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.40.1-7ubuntu0.3"}]}],"versions":["5.40.1-6build1","5.40.1-7build1","5.40.1-7ubuntu0.1","5.40.1-7ubuntu0.2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.38.2-3.2ubuntu0.4"}]}],"versions":["5.36.0-9ubuntu1","5.36.0-10ubuntu1","5.38.2-3","5.38.2-3.2","5.38.2-3.2build1","5.38.2-3.2build2","5.38.2-3.2build2.1","5.38.2-3.2ubuntu0.1","5.38.2-3.2ubuntu0.2","5.38.2-3.2ubuntu0.3"],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.42.0-160000.3.1"}]}],"bundled":5}],"products":[{"vendor":"cato networks","product":"socket"},{"vendor":"pevans","product":"socket"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0)"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0)"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp (6es7518-4fx00-1ab0)"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp (6es7518-4fx00-1ac0)"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp (6ag1518-4ax00-4ac0)"}],"references":[{"url":"https://metacpan.org/release/PEVANS/Socket-2.041/changes","tags":["release-notes","advisory","article"]},{"url":"https://github.com/Perl/perl5/commit/de19a0b0ad1900fef976c5c1400bd8f11ec6c6cb.patch","tags":["patch","fix","article"]},{"url":"http://www.openwall.com/lists/oss-security/2026/06/15/10","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12087","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-q5cv-5vf6-95gp"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-12087","tags":["advisory"]},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/12xxx/CVE-2026-12087.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-12087","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0251.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35708","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/15/10","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2843","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2844","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2845","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2846","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:11342","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12087","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_11342.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489066","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12087","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622847-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1266304","tags":["report"]},{"url":"https://bugzilla.suse.com/1266361","tags":["report"]},{"url":"https://bugzilla.suse.com/1268349","tags":["report"]},{"url":"https://bugzilla.suse.com/1271372","tags":["report"]},{"url":"https://bugzilla.suse.com/1271386","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-15649","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12087","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8376","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622929-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623008-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623075-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263540-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263558-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-12087","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/41020451/","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8675-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8684-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8675-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-13221","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-57432","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-57433","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-15649","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-7017","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-9538","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-48959","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-48962","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-12087","title":"Socket versions before 2.041 for Perl have an out-of-bounds heap read","description":"Socket versions before 2.041 for Perl have an out-of-bounds heap read.\n\nIn Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.\n\nCalling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.","status":"published","published":"2026-06-15T21:11:09.876Z","modified":"2026-11-10T12:40:44.161Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-125","CWE-805"],"updated_at":"2026-11-10T13:38:44.039016Z"}],"euvd":[{"id":"EUVD-2026-37009","description":"Socket versions before 2.041 for Perl have an out-of-bounds heap read.\n\nIn Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.\n\nCalling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.","status":"published","published":"2026-06-15T21:11:09Z","modified":"2026-11-10T12:40:44Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-10T14:21:11.690542Z"}],"ghsa":[{"id":"GHSA-q5cv-5vf6-95gp","title":"Socket versions before 2.041 for Perl have an out-of-bounds heap read.\n\nIn Socket.xs,...","description":"Socket versions before 2.041 for Perl have an out-of-bounds heap read.\n\nIn Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.\n\nCalling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.","status":"published","published":"2026-06-16T00:34:24Z","modified":"2026-11-10T15:32:44Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"cwes":["CWE-125"],"updated_at":"2026-11-10T15:55:01.006697Z"}],"nvd":[{"id":"CVE-2026-12087","description":"Socket versions before 2.041 for Perl have an out-of-bounds heap read.\n\nIn Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.\n\nCalling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.","status":"published","published":"2026-06-15T22:16:16.197Z","modified":"2026-11-10T13:18:23.677Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-125","CWE-805"],"updated_at":"2026-11-10T16:19:46.886348Z"}],"osv":[{"id":"ALPINE-CVE-2026-12087","description":"Socket versions before 2.041 for Perl have an out-of-bounds heap read.\n\nIn Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.\n\nCalling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.","status":"published","published":"2026-06-15T22:16:16.197Z","modified":"2026-11-03T19:30:02.810591533Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-03T20:03:57.215693Z"},{"id":"CVE-2026-12087","title":"Socket versions before 2.041 for Perl have an out-of-bounds heap read","description":"Socket versions before 2.041 for Perl have an out-of-bounds heap read.\n\nIn Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.\n\nCalling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.","status":"published","published":"2026-06-15T21:11:09.876Z","modified":"2026-11-11T02:48:54.121078167Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"cwes":["CWE-125","CWE-805"],"updated_at":"2026-11-11T03:21:33.987049Z"},{"id":"DEBIAN-CVE-2026-12087","description":"Socket versions before 2.041 for Perl have an out-of-bounds heap read.  In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.  Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.","status":"published","published":"2026-06-15T22:16:16.197Z","modified":"2026-11-11T09:47:41.279499413Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-11T10:35:40.696585Z"},{"id":"OESA-2026-2843","title":"perl security update","description":"Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects.\r\n\r\nSecurity Fix(es):\n\nSocket versions before 2.041 for Perl have an out-of-bounds heap read.\n\nIn Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.\n\nCalling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.(CVE-2026-12087)","status":"published","published":"2026-07-06T11:11:45Z","modified":"2026-08-18T01:21:14.121149724Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2844","title":"perl security update","description":"Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects.\r\n\r\nSecurity Fix(es):\n\nSocket versions before 2.041 for Perl have an out-of-bounds heap read.\n\nIn Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.\n\nCalling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.(CVE-2026-12087)","status":"published","published":"2026-07-06T11:11:45Z","modified":"2026-08-18T01:21:13.907058194Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2845","title":"perl security update","description":"Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects.\r\n\r\nSecurity Fix(es):\n\nSocket versions before 2.041 for Perl have an out-of-bounds heap read.\n\nIn Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.\n\nCalling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.(CVE-2026-12087)","status":"published","published":"2026-07-06T11:11:45Z","modified":"2026-08-18T01:21:13.911582571Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2846","title":"perl security update","description":"Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects.\r\n\r\nSecurity Fix(es):\n\nSocket versions before 2.041 for Perl have an out-of-bounds heap read.\n\nIn Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.\n\nCalling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.(CVE-2026-12087)","status":"published","published":"2026-07-06T11:11:45Z","modified":"2026-08-18T01:21:13.942478776Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"RHSA-2026:11342","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-06-18T10:04:55Z","modified":"2026-10-09T10:18:22Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:18.066978Z"},{"id":"UBUNTU-CVE-2026-12087","description":"Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer. Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.","status":"published","published":"2026-06-15T22:16:00Z","modified":"2026-10-17T12:58:04.858644052Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T16:56:00.081948Z"},{"id":"AZL-90156","title":"CVE-2026-12087 affecting package perl for versions less than 5.38.2-512","description":"Socket versions before 2.041 for Perl have an out-of-bounds heap read.\n\nIn Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.\n\nCalling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.","status":"published","published":"2026-06-15T22:16:16Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.633663Z"},{"id":"MGASA-2026-0251","title":"Updated perl-Socket packages fix security vulnerability","description":"Socket versions before 2.041 for Perl have an out-of-bounds heap read.\n(CVE-2026-12087)\n","status":"published","published":"2026-07-14T01:55:37Z","modified":"2026-07-14T02:01:42.416280847Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:21411-1","title":"Security update for perl","description":"This update for perl fixes the following issues:\n\n- CVE-2025-15649: `IO:Uncompress:Unzip` propagates uncaught exception when parsing zip header with malformed DOS date\n  (bsc#1266361).\n- CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds\n  (bsc#1266304).\n- CVE-2026-12087: `Socket`'s `pack_ip_mreq_source()` can copy adjacent heap memory into the returned packed structure\n  (bsc#1268349).\n- CVE-2026-57432: an integer overflow in `S_measure_struct` leads to an out-of-bounds heap read in `pack` and `unpack`\n  (bsc#1271372).\n- CVE-2026-13221: regex trie branch-count overflow leads to silent false-positive/negative pattern matching\n  (bsc#1271386).\n","status":"published","published":"2026-07-22T08:44:23Z","modified":"2026-07-24T18:24:26.392638449Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-12087","title":"CVE-2026-12087 in perl - Patched by Root","description":"Root has patched CVE-2026-12087 in the perl package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-08-23T08:42:48Z","modified":"2026-08-23T10:18:55.433778928Z","updated_at":"2026-11-02T15:53:29.631993Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-12087","title":"CVE-2026-12087 in perl - Patched by Root","description":"Root has patched CVE-2026-12087 in the perl package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2026-09-28T14:31:33Z","modified":"2026-10-08T19:00:05.892871218Z","updated_at":"2026-11-02T15:53:31.773105Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-12087","title":"CVE-2026-12087 in perl - Patched by Root","description":"Root has patched CVE-2026-12087 in the perl package for Root:Debian:13. Multiple fixed versions available.","status":"withdrawn","published":"2026-08-24T16:37:37Z","modified":"2026-09-16T20:00:04.582423779Z","updated_at":"2026-11-02T15:53:33.153539Z"},{"id":"SUSE-SU-2026:22847-1","title":"Security update for perl","description":"This update for perl fixes the following issues:\n\n- CVE-2025-15649: `IO:Uncompress:Unzip` propagates uncaught exception when parsing zip header with malformed DOS date\n  (bsc#1266361).\n- CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds\n  (bsc#1266304).\n- CVE-2026-12087: `Socket`'s `pack_ip_mreq_source()` can copy adjacent heap memory into the returned packed structure\n  (bsc#1268349).\n- CVE-2026-57432: an integer overflow in `S_measure_struct` leads to an out-of-bounds heap read in `pack` and `unpack`\n  (bsc#1271372).\n- CVE-2026-13221: regex trie branch-count overflow leads to silent false-positive/negative pattern matching\n  (bsc#1271386).\n","status":"published","published":"2026-07-22T08:50:06Z","modified":"2026-07-28T18:24:09.632175808Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22929-1","title":"Security update for perl","description":"This update for perl fixes the following issues:\n\n- CVE-2025-15649: `IO:Uncompress:Unzip` propagates uncaught exception when parsing zip header with malformed DOS date\n  (bsc#1266361).\n- CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds\n  (bsc#1266304).\n- CVE-2026-12087: `Socket`'s `pack_ip_mreq_source()` can copy adjacent heap memory into the returned packed structure\n  (bsc#1268349).\n- CVE-2026-57432: an integer overflow in `S_measure_struct` leads to an out-of-bounds heap read in `pack` and `unpack`\n  (bsc#1271372).\n- CVE-2026-13221: regex trie branch-count overflow leads to silent false-positive/negative pattern matching\n  (bsc#1271386).\n","status":"published","published":"2026-07-22T08:50:06Z","modified":"2026-07-29T18:24:20.861695085Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23008-1","title":"Security update for perl","description":"This update for perl fixes the following issues\n\n- CVE-2025-15649: `IO:Uncompress:Unzip` propagates uncaught exception when parsing zip header with malformed DOS date\n  (bsc#1266361).\n- CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds\n  (bsc#1266304).\n- CVE-2026-12087: `Socket`'s `pack_ip_mreq_source()` can copy adjacent heap memory into the returned packed structure\n  (bsc#1268349).\n- CVE-2026-57432: an integer overflow in `S_measure_struct` leads to an out-of-bounds heap read in `pack` and `unpack`\n  (bsc#1271372).\n- CVE-2026-13221: regex trie branch-count overflow leads to silent false-positive/negative pattern matching\n  (bsc#1271386).\n","status":"published","published":"2026-07-28T06:54:58Z","modified":"2026-08-12T18:23:44.013095579Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23075-1","title":"Security update for perl","description":"This update for perl fixes the following issues\n\n- CVE-2025-15649: `IO:Uncompress:Unzip` propagates uncaught exception when parsing zip header with malformed DOS date\n  (bsc#1266361).\n- CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds\n  (bsc#1266304).\n- CVE-2026-12087: `Socket`'s `pack_ip_mreq_source()` can copy adjacent heap memory into the returned packed structure\n  (bsc#1268349).\n- CVE-2026-57432: an integer overflow in `S_measure_struct` leads to an out-of-bounds heap read in `pack` and `unpack`\n  (bsc#1271372).\n- CVE-2026-13221: regex trie branch-count overflow leads to silent false-positive/negative pattern matching\n  (bsc#1271386).\n","status":"published","published":"2026-07-31T10:03:47Z","modified":"2026-08-14T18:23:35.737664787Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:3540-1","title":"Security update for perl","description":"This update for perl fixes the following issues:\n\n- CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds\n  (bsc#1266304).\n- CVE-2026-12087: `Socket`'s `pack_ip_mreq_source()` can copy adjacent heap memory into the returned packed structure\n  (bsc#1268349).\n- CVE-2026-57432: an integer overflow in `S_measure_struct` leads to an out-of-bounds heap read in `pack` and `unpack`\n  (bsc#1271372).\n","status":"published","published":"2026-08-10T11:41:10Z","modified":"2026-08-11T09:15:05.717814758Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3558-1","title":"Security update for perl","description":"This update for perl fixes the following issues:\n\n- CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds\n  (bsc#1266304).\n- CVE-2026-12087: `Socket`'s `pack_ip_mreq_source()` can copy adjacent heap memory into the returned packed structure\n  (bsc#1268349).\n- CVE-2026-57432: an integer overflow in `S_measure_struct` leads to an out-of-bounds heap read in `pack` and `unpack`\n  (bsc#1271372).\n","status":"published","published":"2026-08-10T18:02:08Z","modified":"2026-08-12T10:45:04.850607774Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"USN-8675-1","title":"perl vulnerabilities","description":"It was discovered that Perl incorrectly handled short source addresses\nin the Socket module. An attacker could possibly use this issue to\ntrigger an out-of-bounds heap read, resulting in information disclosure.\n(CVE-2026-12087)\n\nIt was discovered that Perl incorrectly handled regular expressions\ncontaining a large number of fixed string alternatives. An attacker\ncould possibly use this issue to cause incorrect regular expression\nmatches, resulting in security restrictions being bypassed.\n(CVE-2026-13221)\n\nIt was discovered that Perl incorrectly handled certain large repeat\ncounts when processing pack and unpack templates. An attacker could\npossibly use this issue to trigger an out-of-bounds heap read, resulting\nin information disclosure. (CVE-2026-57432)\n\nIt was discovered that Perl incorrectly handled certain crafted data\nwhen deserializing with the Storable module. An attacker could possibly\nuse this issue to trigger an integer overflow and application\ntermination, resulting in a denial of service. (CVE-2026-57433)","status":"published","published":"2026-08-25T14:55:08Z","modified":"2026-08-26T02:15:08.478103723Z","updated_at":"2026-11-02T16:58:25.103481Z"},{"id":"USN-8675-2","title":"perl vulnerabilities","description":"USN-8675-1 fixed vulnerabilities in Perl. This update provides the\ncorresponding fix for Perl on Ubuntu 26.04 LTS.\n\nOriginal advisory details:\n\n It was discovered that Perl incorrectly handled short source addresses\n in the Socket module. An attacker could possibly use this issue to\n trigger an out-of-bounds heap read, resulting in information disclosure.\n (CVE-2026-12087)\n\n It was discovered that Perl incorrectly handled regular expressions\n containing a large number of fixed string alternatives. An attacker\n could possibly use this issue to cause incorrect regular expression\n matches, resulting in security restrictions being bypassed.\n (CVE-2026-13221)\n\n It was discovered that Perl incorrectly handled certain large repeat\n counts when processing pack and unpack templates. An attacker could\n possibly use this issue to trigger an out-of-bounds heap read, resulting\n in information disclosure. (CVE-2026-57432)\n\n It was discovered that Perl incorrectly handled certain crafted data\n when deserializing with the Storable module. An attacker could possibly\n use this issue to trigger an integer overflow and application\n termination, resulting in a denial of service. (CVE-2026-57433)","status":"published","published":"2026-09-09T14:10:59Z","modified":"2026-09-10T00:57:22.504844549Z","updated_at":"2026-11-02T16:58:25.103481Z"},{"id":"USN-8684-1","title":"perl vulnerabilities","description":"It was discovered that Perl incorrectly handled certain arguments to\nSocket and pack/unpack functions. An attacker could possibly use this\nissue to read sensitive information from memory.\n(CVE-2026-12087, CVE-2026-57432)\n\nIt was discovered that Perl incorrectly handled regular expressions\nwith a large number of alternation branches. An attacker could\npossibly use this issue to cause incorrect matching results.\n(CVE-2026-13221)\n\nIt was discovered that Perl incorrectly handled certain files. An\nattacker could possibly use this issue to cause a denial of service.\n(CVE-2026-57433, CVE-2025-15649, CVE-2026-48959, CVE-2026-9538)\n\nIt was discovered that Perl incorrectly handled certain inputs. An\nattacker could possibly use this issue to execute arbitrary code.\n(CVE-2026-48962)\n\nIt was discovered that Perl incorrectly handled credential headers\nduring cross-origin redirects in HTTP::Tiny. An attacker could\npossibly use this issue to expose sensitive information.\n(CVE-2026-7017)","status":"published","published":"2026-08-27T11:10:17Z","modified":"2026-08-31T17:26:26.312880608Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}