CVE-2026-13221: perl Integer Overflow or Wraparound
Vulnerability summary
CVE-2026-13221 is a critical (CVSS 9.1) Integer Overflow or Wraparound vulnerability in perl. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 36.4% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 10 · Related 9Timeline
- 13-07-2026PublishedVulnerability first disclosed.
- 08-09-2026Last modifiedVulnerability information updated.
Description
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.
CVSS metrics
8 scores · 8 sources · 1 version- OSV · AlpineEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- OSV · Red hatEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- NVDNIST9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
EPSS trend
Probability
0.43%
Chance of exploitation in the next 30 days
Percentile
36%
Versus all other CVEs
30-day change
0.00 pp
From 0.43% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat186 products
- perl< 4:5.32.1-484.el9_8 | < 4:5.40.2-515.el10_2 | < 4:5.26.3-423.el8_10.1 | < 4:5.32.1-475.module+el8.10.0+24767+f69b15b5
- perl-Algorithm-Diff< 0:1.1903-10.module+el8.10.0+21354+3ad137bb
- perl-Archive-Tar< 0:2.38-5.module+el8.10.0+24544+66a14188
- perl-Archive-Zip< 0:1.68-3.module+el8.10.0+21354+3ad137bb
- perl-Attribute-Handlers< 0:1.01-484.el9_8 | < 0:1.03-515.el10_2 | < 0:0.99-423.el8_10.1 | < 0:1.01-475.module+el8.10.0+24767+f69b15b5
Chainguard5 products
- miniperl< 5.44.0-r0
- perl< 5.44.0-r0
- perl-dev< 5.44.0-r0
- perl-doc< 5.44.0-r0
- perl-utils< 5.44.0-r0
Wolfi5 products
- miniperl< 5.44.0-r0
- perl< 5.44.0-r0
- perl-dev< 5.44.0-r0
- perl-doc< 5.44.0-r0
- perl-utils< 5.44.0-r0
Alpine1 product
- perl< 5.42.2-r1
Debian1 product
- perl< 5.36.0-7+deb12u4 | < 5.40.1-6+deb13u1 | < 5.42.3-1
Perl1 product
- perl≤ 5.43.9
Ubuntu1 product
- perl< 5.18.2-2ubuntu1.7+esm8 | < 5.22.1-9ubuntu0.9+esm3 | < 5.26.1-6ubuntu0.7+esm3 | < 5.30.0-9ubuntu0.5+esm3 | < 5.34.0-3ubuntu1.8 | < 5.38.2-3.2ubuntu0.4 | < 5.40.1-7ubuntu0.3
7 vendors · 200 products · Showing 200 of 312. Use Open JSON for the complete list.
References
26 linksShow all 26 references
- github.com/Perl/perl5PACKAGE