9.1

CVE-2026-13221: perl Integer Overflow or Wraparound

CVSS: 9.1v3.1CriticalModified
AliasesALPINE-CVE-2026-13221RHSA-2026:67155RHSA-2026:67156
Published 13-07-2026Last modified 08-09-2026

Vulnerability summary

CVE-2026-13221 is a critical (CVSS 9.1) Integer Overflow or Wraparound vulnerability in perl. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 36.4% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.1/10
010
Critical · v3.1 (CVE.org)
EPSS score
0.43%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 10 · Related 9

Timeline

  1. 13-07-2026
    PublishedVulnerability first disclosed.
  2. 08-09-2026
    Last modifiedVulnerability information updated.

Description

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.

CVSS metrics

8 scores · 8 sources · 1 version

EPSS trend

Probability

0.43%

Chance of exploitation in the next 30 days

Percentile

36%

Versus all other CVEs

30-day change

0.00 pp

From 0.43% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.43%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Redhat186 products
  • perl< 4:5.32.1-484.el9_8 | < 4:5.40.2-515.el10_2 | < 4:5.26.3-423.el8_10.1 | < 4:5.32.1-475.module+el8.10.0+24767+f69b15b5
  • perl-Algorithm-Diff< 0:1.1903-10.module+el8.10.0+21354+3ad137bb
  • perl-Archive-Tar< 0:2.38-5.module+el8.10.0+24544+66a14188
  • perl-Archive-Zip< 0:1.68-3.module+el8.10.0+21354+3ad137bb
  • perl-Attribute-Handlers< 0:1.01-484.el9_8 | < 0:1.03-515.el10_2 | < 0:0.99-423.el8_10.1 | < 0:1.01-475.module+el8.10.0+24767+f69b15b5
Chainguard5 products
  • miniperl< 5.44.0-r0
  • perl< 5.44.0-r0
  • perl-dev< 5.44.0-r0
  • perl-doc< 5.44.0-r0
  • perl-utils< 5.44.0-r0
Wolfi5 products
  • miniperl< 5.44.0-r0
  • perl< 5.44.0-r0
  • perl-dev< 5.44.0-r0
  • perl-doc< 5.44.0-r0
  • perl-utils< 5.44.0-r0
Alpine1 product
  • perl< 5.42.2-r1
Debian1 product
  • perl< 5.36.0-7+deb12u4 | < 5.40.1-6+deb13u1 | < 5.42.3-1
Perl1 product
Ubuntu1 product
  • perl< 5.18.2-2ubuntu1.7+esm8 | < 5.22.1-9ubuntu0.9+esm3 | < 5.26.1-6ubuntu0.7+esm3 | < 5.30.0-9ubuntu0.5+esm3 | < 5.34.0-3ubuntu1.8 | < 5.38.2-3.2ubuntu0.4 | < 5.40.1-7ubuntu0.3

7 vendors · 200 products · Showing 200 of 312. Use Open JSON for the complete list.

References

26 links
Show all 26 references