Perl
69 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Perl, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Perl CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 1 |
| 2025-04 | 1 |
| 2025-05 | 1 |
| 2025-06 | 0 |
| 2025-07 | 1 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 1 |
| 2026-04 | 0 |
| 2026-05 | 1 |
| 2026-06 | 0 |
| 2026-07 | 2 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 69 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical14
- High29
- Medium20
- Low6
Latest CVEs
The 15 most recently published vulnerabilities affecting Perl.
- CVE-2026-13221Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk9.1
- CVE-2026-57432Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack8.4
- CVE-2026-8376Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds9.8
- CVE-2026-4176Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib9.8
- CVE-2025-40918Authen::SASL::Perl::DIGEST_MD5 versions 2.04 through 2.1800 for Perl generates the cnonce insecurely6.5
- CVE-2025-40909Perl threads have a working directory race condition where file operations may target unintended paths5.9
- CVE-2024-56406Perl is vulnerable to a heap buffer overflow when transliterating non-ASCII bytes8.4
- CVE-2025-1860Data::Entropy for Perl uses insecure rand() function for cryptographic functions7.7
- CVE-2023-47039Perl: perl for windows binary hijacking vulnerability7.8
- CVE-2023-47038Perl: write past buffer end via illegal user-defined unicode property7.0
- CVE-2022-48522In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation.9.8
- CVE-2023-31486HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.8.1
- CVE-2023-31484CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.8.1
- BDU:2023-00622Уязвимость функции pp_select () интерпретатора Perl, позволяющая нарушителю вызвать отказ в обслуживании4.4
- CVE-2020-16156CPAN 2.28 allows Signature Verification Bypass.7.8
Product grouping is registry-driven, with AI assist and human review. How it works