PT-2026-57822 · Perl · Perl

Published 2026-07-13 · Updated 2026-07-14 · CVE-2026-13221

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Perl versions prior to 5.44

Description Incorrect regular expression matches occur when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl study chunk. A trie is a specialized tree-like data structure used for efficient retrieval of keys. In this case, the delta between the first branch and the shared tail is stored in a 16-bit field; when the branch count exceeds 65535, this field overflows, causing the match decision table to be truncated without warning. This leads to false positive matches and false negative matches, which can result in incorrect access or filtering decisions.

Recommendations Update to a version later than 5.43.9.

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2026-13221

Affected Products

Perl

References · 8

• https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-13221 · Security Note
• https://github.com/Perl/perl5/issues/23388 · Note
• http://openwall.com/lists/oss-security/2026/07/13/5 · Note
• https://twitter.com/CVEnew/status/2076722739847585959 · Twitter Post
• https://twitter.com/oss_security/status/2076871414938743146 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2076726899397607804 · Twitter Post
• https://twitter.com/infoflowcloud/status/2076723545896608140 · Twitter Post