TI-2026-07364 Aliases CVE-2026-8376 GHSA-mpxq-89h3-qc47

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before…

MEDIUM 49CWE-680Published 2026-05-25 · Updated 2026-09-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00567 47th percentileScored 2026-11-07

Fix Partial perl: 5.40.5-RC1, 5.42.3-RC1, 5.43.11Red Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	perl	before 5.40.5-RC1; 5.41.0 to before 5.42.3-RC1; 5.43.0 to before 5.43.11	5.40.5-RC1, 5.42.3-RC1, 5.43.11	Patch available	CNA

perl Vendor— Affected before 5.40.5-RC1; 5.41.0 to before 5.42.3-RC1; 5.43.0 to before 5.43.11 Fixed in 5.40.5-RC1, 5.42.3-RC1, 5.43.11 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:perl:perl::::::::	up to 5.43.10	Vulnerable	Perl

cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:* Versions up to 5.43.10 Vulnerable ·Perl

Remediation

Fix · CNA perl Fixed in 5.40.5-RC1, 5.42.3-RC1, 5.43.11

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 7	Affected	No fix planned: Out of support scope

Not affected: 5 products

Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Red Hat Hardened Images
Red Hat OpenShift Container Platform 4

Timeline

2026-10-02 Threatist record created from CVE-2026-8376
2026-10-03 Alias added: GHSA-mpxq-89h3-qc47

References

Patch 1

https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch

Advisory 1

http://www.openwall.com/lists/oss-security/2026/05/26/1

TI-2022-24100 In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead… CVSS 3.1CRITICAL 9.8
TI-2012-05140 The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl… CVSS 2.0HIGH 7.5
TI-2018-12932 Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular… CVSS 3.0CRITICAL 9.8
TI-2018-12931 Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular… CVSS 3.0CRITICAL 9.8
TI-2018-05049 Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows… CVSS 3.0CRITICAL 9.8
TI-2017-09493 Stack-based buffer overflow in the CPerlHost::Add method in win32/perlhost.h in Perl… CVSS 3.0CRITICAL 9.8

See all 45 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences