PE
Product
Perl
46
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 13High 16Medium 1Low 0
Watch
Add Perl to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-8376 | 9.8 | May 25 | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds Affected: through 5.43.10 |
| CVE-2026-4176 | 9.8 | Mar 29 | Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib Affected: 5.9.4 before 5.40.4; 5.41.0 before 5.42.2; 5.43.0 before 5.43.9 |
| CVE-2022-48522 | 9.8 | Aug 22 | In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation Affected: 5.34.0 |
| CVE-2018-18314 | 9.8 | Dec 7 | Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations Affected: before 5.26.3 |
| CVE-2018-18311 | 9.8 | Dec 7 | Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations Affected: before 5.26.3; 5.28.0 before 5.28.1 |
| CVE-2018-18312 | 9.8 | Dec 5 | Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations Affected: before 5.26.3; 5.28.0 before 5.28.1 |
| CVE-2018-6913 | 9.8 | Apr 17 | Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count Affected: before 5.26.2 |
| CVE-2018-6797 | 9.8 | Apr 17 | An issue was discovered in Perl 5.18 through 5.26 Affected: 5.18 through 5.26 |
| CVE-2017-12814 | 9.8 | Sep 28 | Stack-based buffer overflow in the CPerlHost::Add method in win32/perlhost.h in Perl before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 on Windows allows attackers to execute… Affected: through 5.24.2; 5.26.0 |
| CVE-2015-8608 | 9.8 | Feb 7 | The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of-bounds read) and possibly execute arbitrary code via a… Affected: 5.22 |
| CVE-2026-13221 | 9.1 | Jul 13 | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk Affected: through 5.43.9 |
| CVE-2018-18313 | 9.1 | Dec 7 | Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory Affected: before 5.26.3 |
| CVE-2017-12883 | 9.1 | Sep 19 | Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to disclose sensitive information or… Affected: through 5.24.2; 5.26.0 |
| CVE-2020-10878 | 8.6 | Jun 5 | Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation Affected: before 5.30.3 |
| CVE-2026-57432 | 8.4 | Jul 13 | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack Affected: through 5.43.10 |
| CVE-2024-56406 | 8.4 | Apr 13 | A heap buffer overflow vulnerability was discovered in Perl Affected: 5.33.1 before 5.38.4; 5.39.0 before 5.40.2; 5.41.0 through 5.41.10 |
| CVE-2020-10543 | 8.2 | Jun 5 | Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow Affected: before 5.30.3 |
| CVE-2023-31486 | 8.1 | Apr 29 | HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates Affected: before 5.38.0 |
| CVE-2023-31484 | 8.1 | Apr 29 | CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS Affected: before 5.38.0 |
| CVE-2023-47039 | 7.8 | Jan 2 | A vulnerability was found in Perl Affected: before 5.32.1 |
| CVE-2023-47038 | 7.8 | Dec 18 | A vulnerability was found in perl 5.30.0 through 5.38.0 Affected: 5.30.0 through 5.38.0 |
| CVE-2016-6185 | 7.8 | Aug 2 | The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which might allow local users to execute arbitrary code via a Trojan… Affected: 5.23.0 before 5.24.1; 5.25.0 before 5.25.3 |
| CVE-2016-1238 | 7.8 | Aug 2 | (1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6)… Affected: 1.0.15; 1.0.16; 5.000; 5.000o; 5.001; 5.001n; +34 more |
| CVE-2020-12723 | 7.5 | Jun 5 | regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls Affected: before 5.30.3 |
| CVE-2018-12015 | 7.5 | Jun 7 | In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file… Affected: through 5.26.2 |
| CVE-2018-6798 | 7.5 | Apr 17 | An issue was discovered in Perl 5.22 through 5.26 Affected: 5.22 through 5.26 |
| CVE-2017-12837 | 7.5 | Sep 19 | Heap-based buffer overflow in the S_regatom function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to cause a denial of service… Affected: through 5.24.2; 5.26.0 |
| CVE-2015-8853 | 7.5 | May 25 | The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-dependent attackers to cause a denial of service (infinite… Affected: through 5.23.9 |
| CVE-2016-2381 | 7.5 | Apr 8 | Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp Affected: before 5.23.9 |
| CVE-1999-1386 | 5.5 | Dec 31 | Perl 5.004_04 and earlier follows symbolic links when running with the -e option, which allows local users to overwrite arbitrary files via a symlink attack on the… Affected: through 5.004_04 |
| CVE-2013-7422 | – | Aug 16 | Integer underflow in regcomp.c in Perl before 5.20, as used in Apple OS X before 10.10.5 and other products, allows context-dependent attackers to execute arbitrary code or cause… Affected: 5.18.4 |
| CVE-2014-4330 | – | Sep 30 | The Dumper method in Data::Dumper before 2.154, as used in Perl 5.20.1 and earlier, allows context-dependent attackers to cause a denial of service (stack consumption and crash)… Affected: through 5.20.1 |
| CVE-2010-4777 | – | Feb 10 | The Perl_reg_numbered_buff_fetch function in Perl 5.10.0, 5.12.0, 5.14.0, and other versions, when running with debugging enabled, allows context-dependent attackers to cause a… Affected: 5.10; 5.12.0; 5.14.0 |
| CVE-2013-1667 | – | Mar 14 | The rehash mechanism in Perl 5.8.2 through 5.16.x allows context-dependent attackers to cause a denial of service (memory consumption and crash) via a crafted hash key Affected: 5.8.2; 5.8.3; 5.8.4; 5.8.5; 5.8.6; 5.8.7; +34 more |
| CVE-2012-6329 | – | Jan 4 | The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly handle backslashes and fully qualified method names during… Affected: through 5.16.2; 5.10; 5.10.0; 5.10.0; 5.10.0; 5.10.1; +34 more |
| CVE-2011-2728 | – | Dec 21 | The bsd_glob function in the File::Glob module for Perl before 5.14.2 allows context-dependent attackers to cause a denial of service (crash) via a glob expression with the… Affected: through 5.14.1; 1.00; 1.01; 1.20; 1.21; 1.22; +34 more |
| CVE-2012-5195 | – | Dec 18 | Heap-based buffer overflow in the Perl_repeatcpy function in util.c in Perl 5.12.x before 5.12.5, 5.14.x before 5.14.3, and 5.15.x before 15.15.5 allows context-dependent… Affected: 5.12.0; 5.12.0; 5.12.0; 5.12.0; 5.12.0; 5.12.0; +17 more |
| CVE-2012-1151 | – | Sep 9 | Multiple format string vulnerabilities in dbdimp.c in DBD::Pg (aka DBD-Pg or libdbd-pg-perl) module before 2.19.0 for Perl allow remote PostgreSQL database servers to cause a… Affected: through 2.18.1; 0.1; 0.2; 0.3; 0.4; 0.5; +34 more |
| CVE-2011-2939 | – | Jan 13 | Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause… Affected: through 5.14.2; 5.8.1; 5.8.2; 5.8.3; 5.8.4; 5.8.5; +34 more |
| CVE-2011-0761 | – | May 13 | Perl 5.10.x allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) by leveraging an ability to inject arguments into a… Affected: 5.10.0; 5.10.0; 5.10.0; 5.10.1; 5.10.1; 5.10.1 |
| CVE-2011-1487 | – | Apr 11 | The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do not apply the taint attribute to the… Affected: 5.10.0; 5.10.0; 5.10.0; 5.10.1; 5.10.1; 5.10.1; +34 more |
| CVE-2010-1158 | – | Apr 20 | Integer overflow in the regular expression engine in Perl 5.8.x allows context-dependent attackers to cause a denial of service (stack consumption and application crash) by… Affected: 5.8.1; 5.8.2; 5.8.3; 5.8.4; 5.8.5; 5.8.6; +3 more |
| CVE-2009-3626 | – | Oct 29 | Perl 5.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a UTF-8 character with a large, invalid codepoint, which is not properly… Affected: 5.10.1 |
| CVE-2008-2827 | – | Jun 23 | The rmtree function in lib/File/Path.pm in Perl 5.10 does not properly check permissions before performing a chmod, which allows local users to modify the permissions of arbitrary… Affected: 5.10 |
| CVE-2008-1927 | – | Apr 24 | Double free vulnerability in Perl 5.8.8 allows context-dependent attackers to cause a denial of service (memory corruption and crash) via a crafted regular expression containing… Affected: 5.8.8 |
| CVE-2005-3962 | – | Dec 1 | Integer overflow in the format string functionality (Perl_sv_vcatpvfn) in Perl 5.9.2 and 5.8.6 Perl allows attackers to overwrite arbitrary memory and possibly execute arbitrary… Affected: 5.8.6; 5.9.2 |
Showing 46