Oalders vulnerabilities
We track 3 vulnerabilities in Oalders products across 4 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on July 17, 2026.
Latest Oalders vulnerabilities
- 7.5 High severity
HTTP::Date: Inefficient Regular Expression Complexity
HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date. parse_date() matches the date string against a chain of alternative regexes, and str2time() delegates to it. Several of these patterns place unbounde
- 7.5 High severity
HTML::Entities: Use After Free
HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities. The XS routine backing HTML::Entities::_decode_entities cached a pointer (repl) into the entity-value SV returned by hv_fetch on the entity2char hash. When the input SV wa
- 8.1 High severity
HTTP::Daemon: External Control of File Name or Path
HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file(). send_file() opens its string argument with Perl's 2-arg open(). The 2-arg form interprets magic prefixes: '| cmd' and 'cmd |' open a pipe to a subprocess, '> path' and '>> p