{"id":"CVE-2026-57433","aliases":["ALPINE-CVE-2026-57433","AZL-92415","CLSA-2026-1788175535","CLSA-2026-1788175793","CLSA-2026-1788194548","CLSA-2026-1788334635","DEBIAN-CVE-2026-57433","EUVD-2026-43501","GHSA-r969-gf4c-xqf7","MGASA-2026-0317","OESA-2026-3224","ROOT-OS-DEBIAN-11-CVE-2026-57433","ROOT-OS-DEBIAN-12-CVE-2026-57433","ROOT-OS-DEBIAN-13-CVE-2026-57433","UBUNTU-CVE-2026-57433","USN-8675-1","USN-8675-2","USN-8684-1"],"status":"published","title":"Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record","description":"Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.\n\nretrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.\n\nA crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00475,"percentile":0.41333,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2026-07-13T15:37:04Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"perl","fixed_in":["5.42.3-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"perl","fixed_in":["5.38.2-514"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libperl-dev","fixed_in":["5.26.1-6ubuntu0.7+tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libperl5.26","fixed_in":["5.26.1-6ubuntu0.7+tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"perl","fixed_in":["5.26.1-6ubuntu0.7+tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"perl-base","fixed_in":["5.26.1-6ubuntu0.7+tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"perl-debug","fixed_in":["5.26.1-6ubuntu0.7+tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"perl-doc","fixed_in":["5.26.1-6ubuntu0.7+tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"perl-modules-5.26","fixed_in":["5.26.1-6ubuntu0.7+tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libperl-dev","fixed_in":["5.22.1-9ubuntu0.9+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libperl5.22","fixed_in":["5.22.1-9ubuntu0.9+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"perl","fixed_in":["5.22.1-9ubuntu0.9+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"perl-base","fixed_in":["5.22.1-9ubuntu0.9+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"perl-debug","fixed_in":["5.22.1-9ubuntu0.9+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"perl-doc","fixed_in":["5.22.1-9ubuntu0.9+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"perl-modules-5.22","fixed_in":["5.22.1-9ubuntu0.9+tuxcare.els6"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libperl-dev","fixed_in":["5.30.0-9ubuntu0.5+tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"libperl5.30","fixed_in":["5.30.0-9ubuntu0.5+tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"perl","fixed_in":["5.30.0-9ubuntu0.5+tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"perl-base","fixed_in":["5.30.0-9ubuntu0.5+tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"perl-debug","fixed_in":["5.30.0-9ubuntu0.5+tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"perl-doc","fixed_in":["5.30.0-9ubuntu0.5+tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:20.04","package":"perl-modules-5.30","fixed_in":["5.30.0-9ubuntu0.5+tuxcare.els4"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"perl","fixed_in":["5.36.0-7+deb12u4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"perl","fixed_in":["5.40.1-6+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"perl","fixed_in":["5.40.1-8"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"perl","fixed_in":["5.32.1-4+deb11u5.aikido.6","5.32.1-4+deb11u5.aikido.7","5.32.1-4+deb11u5.aikido.8","5.32.1-4+deb11u5.aikido.9","5.32.1-4+deb11u5.aikido.10","5.32.1-4+deb11u5.aikido.11","5.32.1-4+deb11u5.aikido.12"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-perl","fixed_in":["5.32.1-4+deb11u5.aikido.6","5.32.1-4+deb11u5.aikido.7","5.32.1-4+deb11u5.aikido.8","5.32.1-4+deb11u5.aikido.9","5.32.1-4+deb11u5.aikido.10","5.32.1-4+deb11u5.aikido.11","5.32.1-4+deb11u5.aikido.12"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"perl","fixed_in":["5.18.2-2ubuntu1.7+esm8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"perl","fixed_in":["5.22.1-9ubuntu0.9+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"perl","fixed_in":["5.26.1-6ubuntu0.7+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"perl","fixed_in":["5.30.0-9ubuntu0.5+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"perl","fixed_in":["5.34.0-3ubuntu1.8"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"perl","fixed_in":["5.38.2-3.2ubuntu0.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"perl","fixed_in":["5.40.1-7ubuntu0.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.42.3-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.38.2-514"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libperl-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-6ubuntu0.7+tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libperl5.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-6ubuntu0.7+tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-6ubuntu0.7+tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"perl-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-6ubuntu0.7+tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"perl-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-6ubuntu0.7+tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"perl-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-6ubuntu0.7+tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"perl-modules-5.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-6ubuntu0.7+tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libperl-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.22.1-9ubuntu0.9+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libperl5.22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.22.1-9ubuntu0.9+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.22.1-9ubuntu0.9+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"perl-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.22.1-9ubuntu0.9+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"perl-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.22.1-9ubuntu0.9+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"perl-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.22.1-9ubuntu0.9+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"perl-modules-5.22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.22.1-9ubuntu0.9+tuxcare.els6"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libperl-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.30.0-9ubuntu0.5+tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"libperl5.30","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.30.0-9ubuntu0.5+tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.30.0-9ubuntu0.5+tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"perl-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.30.0-9ubuntu0.5+tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"perl-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.30.0-9ubuntu0.5+tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"perl-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.30.0-9ubuntu0.5+tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:20.04","package":"perl-modules-5.30","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.30.0-9ubuntu0.5+tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libperl-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.28.1-6+deb10u1+tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"libperl5.28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.28.1-6+deb10u1+tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.28.1-6+deb10u1+tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"perl-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.28.1-6+deb10u1+tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"perl-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.28.1-6+deb10u1+tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"perl-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.28.1-6+deb10u1+tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Debian:10","package":"perl-modules-5.28","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.28.1-6+deb10u1+tuxcare.els7"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.36.0-7+deb12u4"}]}],"versions":["5.36.0-7","5.36.0-7+deb12u1","5.36.0-7+deb12u2","5.36.0-7+deb12u3"]},{"source":"osv","ecosystem":"Debian:13","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.40.1-6+deb13u1"}]}],"versions":["5.40.1-6"]},{"source":"osv","ecosystem":"Debian:14","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.40.1-8"}]}],"versions":["5.40.1-6","5.40.1-7"]},{"source":"osv","ecosystem":"Mageia:10","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.42.0-3.mga10"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:9","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.36.0-1.4.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.28.3-14.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.34.0-17.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.38.0-16.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.38.0-16.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.38.0-16.oe2403sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"Root:Debian:11","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.32.1-4+deb11u5.aikido.6"},{"fixed":"5.32.1-4+deb11u5.aikido.7"},{"fixed":"5.32.1-4+deb11u5.aikido.8"},{"fixed":"5.32.1-4+deb11u5.aikido.9"},{"fixed":"5.32.1-4+deb11u5.aikido.10"},{"fixed":"5.32.1-4+deb11u5.aikido.11"},{"fixed":"5.32.1-4+deb11u5.aikido.12"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.32.1-4+deb11u5.aikido.6"},{"fixed":"5.32.1-4+deb11u5.aikido.7"},{"fixed":"5.32.1-4+deb11u5.aikido.8"},{"fixed":"5.32.1-4+deb11u5.aikido.9"},{"fixed":"5.32.1-4+deb11u5.aikido.10"},{"fixed":"5.32.1-4+deb11u5.aikido.11"},{"fixed":"5.32.1-4+deb11u5.aikido.12"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.2-2ubuntu1.7+esm8"}]}],"versions":["5.14.2-21build1","5.18.1-4","5.18.1-4build1","5.18.1-5","5.18.2-2","5.18.2-2ubuntu1","5.18.2-2ubuntu1.1","5.18.2-2ubuntu1.3","5.18.2-2ubuntu1.4","5.18.2-2ubuntu1.6","5.18.2-2ubuntu1.7","5.18.2-2ubuntu1.7+esm3","5.18.2-2ubuntu1.7+esm4","5.18.2-2ubuntu1.7+esm5","5.18.2-2ubuntu1.7+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.22.1-9ubuntu0.9+esm3"}]}],"versions":["5.20.2-6","5.22.1-3","5.22.1-4","5.22.1-5","5.22.1-7","5.22.1-8","5.22.1-9","5.22.1-9ubuntu0.2","5.22.1-9ubuntu0.3","5.22.1-9ubuntu0.5","5.22.1-9ubuntu0.6","5.22.1-9ubuntu0.9","5.22.1-9ubuntu0.9+esm1","5.22.1-9ubuntu0.9+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-6ubuntu0.7+esm3"}]}],"versions":["5.26.0-8ubuntu1","5.26.1-2ubuntu1","5.26.1-3","5.26.1-4","5.26.1-4build1","5.26.1-5","5.26.1-6","5.26.1-6ubuntu0.1","5.26.1-6ubuntu0.2","5.26.1-6ubuntu0.3","5.26.1-6ubuntu0.5","5.26.1-6ubuntu0.6","5.26.1-6ubuntu0.7","5.26.1-6ubuntu0.7+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.30.0-9ubuntu0.5+esm3"}]}],"versions":["5.28.1-6build1","5.30.0-7","5.30.0-9","5.30.0-9build1","5.30.0-9ubuntu0.2","5.30.0-9ubuntu0.3","5.30.0-9ubuntu0.4","5.30.0-9ubuntu0.5","5.30.0-9ubuntu0.5+esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.34.0-3ubuntu1.8"}]}],"versions":["5.32.1-3ubuntu3","5.34.0-3ubuntu1","5.34.0-3ubuntu1.1","5.34.0-3ubuntu1.2","5.34.0-3ubuntu1.3","5.34.0-3ubuntu1.4","5.34.0-3ubuntu1.5","5.34.0-3ubuntu1.7"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.38.2-3.2ubuntu0.4"}]}],"versions":["5.36.0-9ubuntu1","5.36.0-10ubuntu1","5.38.2-3","5.38.2-3.2","5.38.2-3.2build1","5.38.2-3.2build2","5.38.2-3.2build2.1","5.38.2-3.2ubuntu0.1","5.38.2-3.2ubuntu0.2","5.38.2-3.2ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.40.1-7ubuntu0.3"}]}],"versions":["5.40.1-6build1","5.40.1-7build1","5.40.1-7ubuntu0.1","5.40.1-7ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.2-2ubuntu1.7+esm8"}]}],"versions":["5.14.2-21build1","5.18.1-4","5.18.1-4build1","5.18.1-5","5.18.2-2","5.18.2-2ubuntu1","5.18.2-2ubuntu1.1","5.18.2-2ubuntu1.3","5.18.2-2ubuntu1.4","5.18.2-2ubuntu1.6","5.18.2-2ubuntu1.7","5.18.2-2ubuntu1.7+esm3","5.18.2-2ubuntu1.7+esm4","5.18.2-2ubuntu1.7+esm5","5.18.2-2ubuntu1.7+esm7"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.22.1-9ubuntu0.9+esm3"}]}],"versions":["5.20.2-6","5.22.1-3","5.22.1-4","5.22.1-5","5.22.1-7","5.22.1-8","5.22.1-9","5.22.1-9ubuntu0.2","5.22.1-9ubuntu0.3","5.22.1-9ubuntu0.5","5.22.1-9ubuntu0.6","5.22.1-9ubuntu0.9","5.22.1-9ubuntu0.9+esm1","5.22.1-9ubuntu0.9+esm2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-6ubuntu0.7+esm3"}]}],"versions":["5.26.0-8ubuntu1","5.26.1-2ubuntu1","5.26.1-3","5.26.1-4","5.26.1-4build1","5.26.1-5","5.26.1-6","5.26.1-6ubuntu0.1","5.26.1-6ubuntu0.2","5.26.1-6ubuntu0.3","5.26.1-6ubuntu0.5","5.26.1-6ubuntu0.6","5.26.1-6ubuntu0.7","5.26.1-6ubuntu0.7+esm2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.30.0-9ubuntu0.5+esm3"}]}],"versions":["5.28.1-6build1","5.30.0-7","5.30.0-9","5.30.0-9build1","5.30.0-9ubuntu0.2","5.30.0-9ubuntu0.3","5.30.0-9ubuntu0.4","5.30.0-9ubuntu0.5","5.30.0-9ubuntu0.5+esm2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.34.0-3ubuntu1.8"}]}],"versions":["5.32.1-3ubuntu3","5.34.0-3ubuntu1","5.34.0-3ubuntu1.1","5.34.0-3ubuntu1.2","5.34.0-3ubuntu1.3","5.34.0-3ubuntu1.4","5.34.0-3ubuntu1.5","5.34.0-3ubuntu1.7"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.40.1-7ubuntu0.3"}]}],"versions":["5.40.1-6build1","5.40.1-7build1","5.40.1-7ubuntu0.1","5.40.1-7ubuntu0.2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.38.2-3.2ubuntu0.4"}]}],"versions":["5.36.0-9ubuntu1","5.36.0-10ubuntu1","5.38.2-3","5.38.2-3.2","5.38.2-3.2build1","5.38.2-3.2build2","5.38.2-3.2build2.1","5.38.2-3.2ubuntu0.1","5.38.2-3.2ubuntu0.2","5.38.2-3.2ubuntu0.3"],"bundled":9}],"products":[{"vendor":"haarg","product":"storable"},{"vendor":"nwclark","product":"storable"}],"references":[{"url":"https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.patch","tags":["patch","Patch","fix"]},{"url":"http://www.openwall.com/lists/oss-security/2026/07/13/7","tags":["Mailing List","Patch","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57433","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-r969-gf4c-xqf7"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-57433","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1788175535.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1788175793.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1788194548.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1788334635.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9538","tags":["advisory"]},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57433.json","tags":["advisory"]},{"url":"https://github.com/Perl/perl5","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-57433","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0317.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35925","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/13/5","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/13/6","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/13/7","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3224","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57432","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-57433","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-57433","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/41780100/","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8675-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8684-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8675-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-12087","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-13221","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-57432","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-15649","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-7017","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-9538","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-48959","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-48962","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-57433","title":"Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record","description":"Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.\n\nretrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.\n\nA crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.","status":"published","published":"2026-07-13T15:37:04.517Z","modified":"2026-07-14T13:36:37.394Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T13:43:56.024247Z"}],"euvd":[{"id":"EUVD-2026-43501","description":"Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.\n\nretrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.\n\nA crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.","status":"published","published":"2026-07-13T15:37:04Z","modified":"2026-07-14T13:36:37Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:20:00.206712Z"}],"ghsa":[{"id":"GHSA-r969-gf4c-xqf7","title":"Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a...","description":"Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.\n\nretrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.\n\nA crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.","status":"published","published":"2026-07-13T18:30:52Z","modified":"2026-07-14T15:32:09Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:09:27.031Z"}],"nvd":[{"id":"CVE-2026-57433","description":"Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.\n\nretrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.\n\nA crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.","status":"published","published":"2026-07-13T17:17:55.783Z","modified":"2026-10-24T22:10:00.21Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:12:29.114188Z"}],"osv":[{"id":"ALPINE-CVE-2026-57433","description":"Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.\n\nretrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.\n\nA crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.","status":"published","published":"2026-07-13T17:17:55.783Z","modified":"2026-11-03T19:30:03.596521396Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T20:03:57.215693Z"},{"id":"CVE-2026-57433","title":"Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record","description":"Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.\n\nretrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.\n\nA crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.","status":"published","published":"2026-07-13T15:37:04.517Z","modified":"2026-10-28T02:30:50.408835861Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:45:12.016252Z"},{"id":"DEBIAN-CVE-2026-57433","description":"Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.  retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.  A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.","status":"published","published":"2026-07-13T17:17:55.783Z","modified":"2026-10-25T09:47:33.611679877Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:57.590991Z"},{"id":"OESA-2026-3224","title":"perl security update","description":"Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects.\r\n\r\nSecurity Fix(es):\n\nPerl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item\u0026apos;s size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller.(CVE-2026-57432)\n\nStorable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.\n\nretrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.\n\nA crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.(CVE-2026-57433)","status":"published","published":"2026-08-01T11:12:05Z","modified":"2026-08-18T01:21:26.071726245Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"UBUNTU-CVE-2026-57433","description":"Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.","status":"published","published":"2026-07-13T17:17:00Z","modified":"2026-09-10T00:56:34.867790105Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"AZL-92415","title":"CVE-2026-57433 affecting package perl for versions less than 5.38.2-514","description":"Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.\n\nretrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.\n\nA crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.","status":"published","published":"2026-07-13T17:17:55Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.880689Z"},{"id":"CLSA-2026-1788175535","title":"Fix CVE(s): CVE-2026-57433","description":"   * SECURITY UPDATE: signed integer overflow when deserializing a crafted\n     Storable SX_HOOK record\n     - debian/patches/CVE-2026-57433.patch: reject a hook data item count of\n       I32_MAX in retrieve_hook() in dist/Storable/Storable.xs before it is\n       incremented and passed to av_extend()\n     - CVE-2026-57433","status":"published","published":"2026-08-31T11:25:47Z","modified":"2026-10-26T09:32:03.922998172Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1788175793","title":"Fix CVE(s): CVE-2026-57433","description":"   * SECURITY UPDATE: signed integer overflow in Storable SX_HOOK deserialization\n     - debian/patches/fixes/CVE-2026-57433.patch: croak on a hook data item\n       count of I32_MAX before av_extend() is called with an overflowed\n       negative count in retrieve_hook() in dist/Storable/Storable.xs\n     - CVE-2026-57433","status":"published","published":"2026-08-31T11:30:04Z","modified":"2026-10-26T09:32:02.217619268Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1788194548","title":"Fix CVE(s): CVE-2026-57433","description":"   * SECURITY UPDATE: denial of service via signed integer overflow when\n     deserializing a crafted Storable blob\n     - debian/patches/CVE-2026-57433.patch: reject a hook data item count of\n       I32_MAX in retrieve_hook_common() in dist/Storable/Storable.xs before\n       it is incremented and passed to av_extend(); backported from upstream\n       commit e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.\n     - CVE-2026-57433","status":"published","published":"2026-08-31T16:42:40Z","modified":"2026-10-26T09:31:40.192532152Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1788334635","title":"Fix CVE(s): CVE-2026-57433, CVE-2026-9538","description":"   * SECURITY UPDATE: denial of service via signed integer overflow when\n     deserializing a crafted Storable blob\n     - debian/patches/fixes/CVE-2026-57433.patch: reject a hook data item\n       count of I32_MAX in retrieve_hook_common() in\n       dist/Storable/Storable.xs before it is incremented and passed to\n       av_extend(); backported from upstream commit\n       e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.\n     - CVE-2026-57433","status":"published","published":"2026-09-02T07:37:26Z","modified":"2026-10-26T09:31:53.123135523Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"MGASA-2026-0317","title":"Updated perl packages fix security vulnerabilities","description":"The updated Mageia 10 perl packages contain security fixes for\nCVE-2026-13221, CVE-2026-57432 and CVE-2026-57433.\nThe Mageia 9 perl packages were not affected by CVE-2026-13221, they are\nnow updated with fixes for CVE-2026-57432 and CVE-2026-57433.\n","status":"published","published":"2026-08-03T18:47:23Z","modified":"2026-08-03T19:00:05.42908151Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-57433","title":"CVE-2026-57433 in perl - Patched by Root","description":"Root has patched CVE-2026-57433 in the perl package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-08-23T08:42:48Z","modified":"2026-08-23T10:15:33.419755478Z","updated_at":"2026-11-02T15:53:30.44348Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-57433","title":"CVE-2026-57433 in perl - Patched by Root","description":"Root has patched CVE-2026-57433 in the perl package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2026-09-28T14:31:33Z","modified":"2026-10-08T19:00:07.018659058Z","updated_at":"2026-11-02T15:53:32.570806Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-57433","title":"CVE-2026-57433 in perl - Patched by Root","description":"Root has patched CVE-2026-57433 in the perl package for Root:Debian:13. Multiple fixed versions available.","status":"withdrawn","published":"2026-08-24T16:37:37Z","modified":"2026-09-16T20:00:05.455514006Z","updated_at":"2026-11-02T15:53:33.681527Z"},{"id":"USN-8675-1","title":"perl vulnerabilities","description":"It was discovered that Perl incorrectly handled short source addresses\nin the Socket module. An attacker could possibly use this issue to\ntrigger an out-of-bounds heap read, resulting in information disclosure.\n(CVE-2026-12087)\n\nIt was discovered that Perl incorrectly handled regular expressions\ncontaining a large number of fixed string alternatives. An attacker\ncould possibly use this issue to cause incorrect regular expression\nmatches, resulting in security restrictions being bypassed.\n(CVE-2026-13221)\n\nIt was discovered that Perl incorrectly handled certain large repeat\ncounts when processing pack and unpack templates. An attacker could\npossibly use this issue to trigger an out-of-bounds heap read, resulting\nin information disclosure. (CVE-2026-57432)\n\nIt was discovered that Perl incorrectly handled certain crafted data\nwhen deserializing with the Storable module. An attacker could possibly\nuse this issue to trigger an integer overflow and application\ntermination, resulting in a denial of service. (CVE-2026-57433)","status":"published","published":"2026-08-25T14:55:08Z","modified":"2026-08-26T02:15:08.478103723Z","updated_at":"2026-11-02T16:58:25.103481Z"},{"id":"USN-8675-2","title":"perl vulnerabilities","description":"USN-8675-1 fixed vulnerabilities in Perl. This update provides the\ncorresponding fix for Perl on Ubuntu 26.04 LTS.\n\nOriginal advisory details:\n\n It was discovered that Perl incorrectly handled short source addresses\n in the Socket module. An attacker could possibly use this issue to\n trigger an out-of-bounds heap read, resulting in information disclosure.\n (CVE-2026-12087)\n\n It was discovered that Perl incorrectly handled regular expressions\n containing a large number of fixed string alternatives. An attacker\n could possibly use this issue to cause incorrect regular expression\n matches, resulting in security restrictions being bypassed.\n (CVE-2026-13221)\n\n It was discovered that Perl incorrectly handled certain large repeat\n counts when processing pack and unpack templates. An attacker could\n possibly use this issue to trigger an out-of-bounds heap read, resulting\n in information disclosure. (CVE-2026-57432)\n\n It was discovered that Perl incorrectly handled certain crafted data\n when deserializing with the Storable module. An attacker could possibly\n use this issue to trigger an integer overflow and application\n termination, resulting in a denial of service. (CVE-2026-57433)","status":"published","published":"2026-09-09T14:10:59Z","modified":"2026-09-10T00:57:22.504844549Z","updated_at":"2026-11-02T16:58:25.103481Z"},{"id":"USN-8684-1","title":"perl vulnerabilities","description":"It was discovered that Perl incorrectly handled certain arguments to\nSocket and pack/unpack functions. An attacker could possibly use this\nissue to read sensitive information from memory.\n(CVE-2026-12087, CVE-2026-57432)\n\nIt was discovered that Perl incorrectly handled regular expressions\nwith a large number of alternation branches. An attacker could\npossibly use this issue to cause incorrect matching results.\n(CVE-2026-13221)\n\nIt was discovered that Perl incorrectly handled certain files. An\nattacker could possibly use this issue to cause a denial of service.\n(CVE-2026-57433, CVE-2025-15649, CVE-2026-48959, CVE-2026-9538)\n\nIt was discovered that Perl incorrectly handled certain inputs. An\nattacker could possibly use this issue to execute arbitrary code.\n(CVE-2026-48962)\n\nIt was discovered that Perl incorrectly handled credential headers\nduring cross-origin redirects in HTTP::Tiny. An attacker could\npossibly use this issue to expose sensitive information.\n(CVE-2026-7017)","status":"published","published":"2026-08-27T11:10:17Z","modified":"2026-08-31T17:26:26.312880608Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}