Perl vulnerabilities
We track 9 vulnerabilities in Perl products across 3 products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on July 13, 2026.
Latest Perl vulnerabilities
- 8.4 High severity
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP…: Out-of-bounds Read
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a
- 9.1 Critical severity
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP…: Integer Overflow or Wraparound
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such
- 8.8 High severity
Dbi: Improper Neutralization of Directives in Dynamically Evaluated Code
DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval
- 9.8 Critical severity
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP…: Integer Overflow to Buffer Overflow
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the
- 8.4 High severity
perl: Out-of-bounds Write
A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10. When there are non-ASCII bytes in the left-hand-side of the `tr` operator, `S_do_t
- 8.8 High severity
Crypt::Random: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Crypt::Random Perl package 1.05 through 1.55 may use rand() function, which is not cryptographically strong, for cryptographic functions. If the Provider is not specified and /dev/urandom or an Entropy Gathering Daemon (egd) service is not available Crypt::Ran
- 7.8 High severity
Red Hat Enterprise Linux 6: Out-of-bounds Write
A vulnerability was found in Perl. This security issue occurs while Perl for Windows relies on the system path environment variable to find the shell (`cmd.exe`). When running an executable that uses the Windows Perl interpreter, Perl attempts to find and exec
- 7.8 High severity
Red Hat Enterprise Linux 8: Out-of-bounds Write
A vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.
- 8.1 High severity
Perl: Improper Certificate Validation
HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.