Read the docs
TI-2018-12931 Aliases CVE-2018-18311GHSA-qr73-9894-ffxf

Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular…

Priority MEDIUM 56CWE-190Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 32 fixed, 3 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-190 and the CVSS impact.

Summary

Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

Why it matters now

EPSS 0.11676 96th percentileScored 2026-11-07
Fix Partial Red Hat: 7 advisoriesRed Hat: 32 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 27

CPEVersionsRoleVendor
cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:*before 5.26.3; 5.28.0 to before 5.28.1VulnerablePerl
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*12.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*14.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*16.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*18.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*18.10VulnerableCanonical
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:a:netapp:e-series_santricity_os_controller:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:* Versions before 5.26.3; 5.28.0 to before 5.28.1 Vulnerable ·Perl
  • cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:* Versions 12.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* Versions 14.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:* Versions 18.10 Vulnerable ·Canonical
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:a:netapp:e-series_santricity_os_controller:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Show 17 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:snapdriver:-:*:*:*:*:unix:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*3.11VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.4:*:*:*:*:*:*:*7.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.5:*:*:*:*:*:*:*7.5VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.6:*:*:*:*:*:*:*7.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*7.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*7.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*7.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*before 10.14.4VulnerableApple
cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*29VulnerableFedoraproject
cpe:2.3:a:mcafee:web_gateway:*:*:*:*:*:*:*:*7.7.2 to before 7.7.2.21; 7.8.2 to before 7.8.2.8; 8.0.0 to before 8.1.1VulnerableMcAfee
  • cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:snapdriver:-:*:*:*:*:unix:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:* Versions 3.11 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.5:*:*:*:*:*:*:* Versions 7.5 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.6:*:*:*:*:*:*:* Versions 7.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:* Versions 7.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:* Versions 7.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:* Versions 7.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* Versions before 10.14.4 Vulnerable ·Apple
  • cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* Versions 29 Vulnerable ·Fedoraproject
  • cpe:2.3:a:mcafee:web_gateway:*:*:*:*:*:*:*:* Versions 7.7.2 to before 7.7.2.21; 7.8.2 to before 7.8.2.8; 8.0.0 to before 8.1.1 Vulnerable ·McAfee

Remediation

Red Hat 7 advisories

  • RHSA-2026:7604 Released 2026-04-10 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images perl-5.42.2-524.1.hum1@aarch64, perl-5.42.2-524.1.hum1@src, perl-5.42.2-524.1.hum1@x86_64 +47
  • RHSA-2019:2400 Released 2019-08-07 · Red Hat rating Important
    perl security update
    • Red Hat Enterprise Linux Server AUS (v. 7.3) perl-4:5.16.3-291.el7_3.1, perl-CPAN-1.9800-291.el7_3.1, perl-ExtUtils-CBuilder-1:0.28.2.6-291.el7_3.1 +14
    • Red Hat Enterprise Linux Server E4S (v. 7.3) perl-4:5.16.3-291.el7_3.1, perl-CPAN-1.9800-291.el7_3.1, perl-ExtUtils-CBuilder-1:0.28.2.6-291.el7_3.1 +14
    • Red Hat Enterprise Linux Server Optional AUS (v. 7.3) perl-Perl4-CoreLibs-0.001-291.el7_3.1, perl-tests-4:5.16.3-291.el7_3.1
    • Red Hat Enterprise Linux Server Optional E4S (v. 7.3) perl-Perl4-CoreLibs-0.001-291.el7_3.1, perl-tests-4:5.16.3-291.el7_3.1
    • Red Hat Enterprise Linux Server Optional TUS (v. 7.3) perl-Perl4-CoreLibs-0.001-291.el7_3.1, perl-tests-4:5.16.3-291.el7_3.1
    • Red Hat Enterprise Linux Server TUS (v. 7.3) perl-4:5.16.3-291.el7_3.1, perl-CPAN-1.9800-291.el7_3.1, perl-ExtUtils-CBuilder-1:0.28.2.6-291.el7_3.1 +14
  • RHSA-2019:1942 Released 2019-07-30 · Red Hat rating Important
    perl security update
    • Red Hat Enterprise Linux ComputeNode EUS (v. 7.4) perl-4:5.16.3-292.el7_4.1, perl-CPAN-1.9800-292.el7_4.1, perl-ExtUtils-CBuilder-1:0.28.2.6-292.el7_4.1 +14
    • Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.4) perl-tests-4:5.16.3-292.el7_4.1
    • Red Hat Enterprise Linux Server EUS (v. 7.4) perl-4:5.16.3-292.el7_4.1, perl-CPAN-1.9800-292.el7_4.1, perl-ExtUtils-CBuilder-1:0.28.2.6-292.el7_4.1 +16
    • Red Hat Enterprise Linux Server Optional EUS (v. 7.4) perl-tests-4:5.16.3-292.el7_4.1
Show 4 more Red Hat advisories
  • RHSA-2019:1790 Released 2019-07-16 · Red Hat rating Important
    perl security update
    • Red Hat Enterprise Linux ComputeNode EUS (v. 7.5) perl-4:5.16.3-292.el7_5.1, perl-CPAN-1.9800-292.el7_5.1, perl-ExtUtils-CBuilder-1:0.28.2.6-292.el7_5.1 +14
    • Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.5) perl-tests-4:5.16.3-292.el7_5.1
    • Red Hat Enterprise Linux Server EUS (v. 7.5) perl-4:5.16.3-292.el7_5.1, perl-CPAN-1.9800-292.el7_5.1, perl-ExtUtils-CBuilder-1:0.28.2.6-292.el7_5.1 +16
    • Red Hat Enterprise Linux Server Optional EUS (v. 7.5) perl-tests-4:5.16.3-292.el7_5.1
  • RHSA-2019:0109 Released 2019-01-21 · Red Hat rating Important
    perl security update
    • Red Hat Enterprise Linux Client (v. 7) perl-4:5.16.3-294.el7_6, perl-CPAN-1.9800-294.el7_6, perl-ExtUtils-CBuilder-1:0.28.2.6-294.el7_6 +14
    • Red Hat Enterprise Linux Client Optional (v. 7) perl-tests-4:5.16.3-294.el7_6
    • Red Hat Enterprise Linux ComputeNode (v. 7) perl-4:5.16.3-294.el7_6, perl-CPAN-1.9800-294.el7_6, perl-ExtUtils-CBuilder-1:0.28.2.6-294.el7_6 +14
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) perl-tests-4:5.16.3-294.el7_6
    • Red Hat Enterprise Linux Server (v. 7) perl-4:5.16.3-294.el7_6, perl-CPAN-1.9800-294.el7_6, perl-ExtUtils-CBuilder-1:0.28.2.6-294.el7_6 +16
    • Red Hat Enterprise Linux Server Optional (v. 7) perl-tests-4:5.16.3-294.el7_6
    • Red Hat Enterprise Linux Workstation (v. 7) perl-4:5.16.3-294.el7_6, perl-CPAN-1.9800-294.el7_6, perl-ExtUtils-CBuilder-1:0.28.2.6-294.el7_6 +14
    • Red Hat Enterprise Linux Workstation Optional (v. 7) perl-tests-4:5.16.3-294.el7_6
    • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) perl-4:5.16.3-294.el7_6, perl-CPAN-1.9800-294.el7_6, perl-ExtUtils-CBuilder-1:0.28.2.6-294.el7_6 +14
    • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) perl-tests-4:5.16.3-294.el7_6
  • RHSA-2019:0010 Released 2019-01-02 · Red Hat rating Important
    rh-perl524-perl security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-perl524-perl-4:5.24.0-381.el6, rh-perl524-perl-Attribute-Handlers-0.99-381.el6, rh-perl524-perl-Devel-Peek-1.23-381.el6 +26
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-perl524-perl-4:5.24.0-381.el7, rh-perl524-perl-Attribute-Handlers-0.99-381.el7, rh-perl524-perl-Devel-Peek-1.23-381.el7 +26
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-perl524-perl-4:5.24.0-381.el7, rh-perl524-perl-Attribute-Handlers-0.99-381.el7, rh-perl524-perl-Devel-Peek-1.23-381.el7 +26
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-perl524-perl-4:5.24.0-381.el7, rh-perl524-perl-Attribute-Handlers-0.99-381.el7, rh-perl524-perl-Devel-Peek-1.23-381.el7 +26
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-perl524-perl-4:5.24.0-381.el7, rh-perl524-perl-Attribute-Handlers-0.99-381.el7, rh-perl524-perl-Devel-Peek-1.23-381.el7 +26
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-perl524-perl-4:5.24.0-381.el6, rh-perl524-perl-Attribute-Handlers-0.99-381.el6, rh-perl524-perl-Devel-Peek-1.23-381.el6 +26
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-perl524-perl-4:5.24.0-381.el7, rh-perl524-perl-Attribute-Handlers-0.99-381.el7, rh-perl524-perl-Devel-Peek-1.23-381.el7 +26
  • RHSA-2019:0001 Released 2019-01-02 · Red Hat rating Important
    rh-perl526-perl security and enhancement update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-perl526-perl-4:5.26.3-405.el7, rh-perl526-perl-Attribute-Handlers-0.99-405.el7, rh-perl526-perl-Devel-Peek-1.26-405.el7 +25
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-perl526-perl-4:5.26.3-405.el7, rh-perl526-perl-Attribute-Handlers-0.99-405.el7, rh-perl526-perl-Devel-Peek-1.26-405.el7 +25
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-perl526-perl-4:5.26.3-405.el7, rh-perl526-perl-Attribute-Handlers-0.99-405.el7, rh-perl526-perl-Devel-Peek-1.26-405.el7 +25
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-perl526-perl-4:5.26.3-405.el7, rh-perl526-perl-Attribute-Handlers-0.99-405.el7, rh-perl526-perl-Devel-Peek-1.26-405.el7 +25
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-perl526-perl-4:5.26.3-405.el7, rh-perl526-perl-Attribute-Handlers-0.99-405.el7, rh-perl526-perl-Devel-Peek-1.26-405.el7 +25

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 5AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix
Red Hat Virtualization 4AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2019:0109
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2019:0109
Red Hat Enterprise Linux ComputeNode (v. 7)Fixed RHSA-2019:0109
Red Hat Enterprise Linux ComputeNode EUS (v. 7.4)Fixed RHSA-2019:1942
Red Hat Enterprise Linux ComputeNode EUS (v. 7.5)Fixed RHSA-2019:1790
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2019:0109
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.4)Fixed RHSA-2019:1942
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.5)Fixed RHSA-2019:1790
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2019:0109
Red Hat Enterprise Linux Server AUS (v. 7.3)Fixed RHSA-2019:2400
Red Hat Enterprise Linux Server E4S (v. 7.3)Fixed RHSA-2019:2400
Red Hat Enterprise Linux Server EUS (v. 7.4)Fixed RHSA-2019:1942
Red Hat Enterprise Linux Server EUS (v. 7.5)Fixed RHSA-2019:1790
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2019:0109
Red Hat Enterprise Linux Server Optional AUS (v. 7.3)Fixed RHSA-2019:2400
Red Hat Enterprise Linux Server Optional E4S (v. 7.3)Fixed RHSA-2019:2400
Red Hat Enterprise Linux Server Optional EUS (v. 7.4)Fixed RHSA-2019:1942
Red Hat Enterprise Linux Server Optional EUS (v. 7.5)Fixed RHSA-2019:1790
Red Hat Enterprise Linux Server Optional TUS (v. 7.3)Fixed RHSA-2019:2400
Red Hat Enterprise Linux Server TUS (v. 7.3)Fixed RHSA-2019:2400
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2019:0109
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2019:0109
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)Fixed RHSA-2019:0109
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)Fixed RHSA-2019:0109
Red Hat Hardened ImagesFixed RHSA-2026:7604
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2019:0010
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2019:0001, RHSA-2019:0010
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)Fixed RHSA-2019:0001, RHSA-2019:0010
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)Fixed RHSA-2019:0001, RHSA-2019:0010
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)Fixed RHSA-2019:0001, RHSA-2019:0010
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2019:0010
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2019:0001, RHSA-2019:0010
Not affected: 2 products
  • Red Hat Enterprise Linux 8
  • Red Hat OpenShift Enterprise 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-18311
  2. 2026-10-03 Alias added: GHSA-qr73-9894-ffxf

References

Patch 2

Advisory 21

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences