Perl vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited Perl flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2021-22204 ExifTool Remote Code ExecutionExploited since Nov 17, 2021 · CVSS 6.8

Latest high and critical flaws

• CVE-2026-57432 Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bouHigh 8.4 · Jul 13, 2026
• CVE-2026-13221 Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternaCritical 9.1 · Jul 13, 2026
• CVE-2026-14380 DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile.High 8.8 · Jul 7, 2026
• CVE-2026-8376 Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with aCritical 9.8 · May 25, 2026
• CVE-2024-56406 A heap buffer overflow vulnerability was discovered in Perl.High 8.4 · Apr 13, 2025
• CVE-2025-1828 Crypt::Random Perl package 1.05 through 1.55 may use rand() function, which is not cryptographically strong, for cryptographic functions.High 8.8 · Mar 10, 2025
• CVE-2024-55564 The POSIX::2008 package before 0.24 for Perl has a potential _execve50c env buffer overflow.Critical 9.8 · Dec 8, 2024
• CVE-2024-45321 The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers.High 8.1 · Aug 27, 2024
• CVE-2021-47155 The Net::IPV4Addr module 0.10 for Perl does not properly consider extraneous zero characters in an IP address string, which (in some situations) allows attackerCritical 9.1 · Mar 18, 2024
• CVE-2020-16156 CPAN 2.28 allows Signature Verification Bypass.High 7.8 · Dec 13, 2021
• CVE-2020-14393 A buffer overflow was found in perl-DBI < 1.643 in DBI.xs.High 7.1 · Sep 16, 2020
• CVE-2018-18314 Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations.Critical 9.8 · Dec 7, 2018
• CVE-2018-18313 Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory.Critical 9.1 · Dec 7, 2018
• CVE-2018-18311 Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.Critical 9.8 · Dec 7, 2018
• CVE-2018-18312 Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.Critical 9.8 · Dec 5, 2018
• CVE-2017-12814 Stack-based buffer overflow in the CPerlHost::Add method in win32/perlhost.h in Perl before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 on Windows allows attackers Critical 9.8 · Sep 27, 2017
• CVE-2017-12883 Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to disclose sensitCritical 9.1 · Sep 19, 2017
• CVE-2017-12837 Heap-based buffer overflow in the S_regatom function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to cause a deHigh 7.5 · Sep 19, 2017
• CVE-2015-8608 The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of-bounds read) and possibly execute arbitCritical 9.8 · Feb 7, 2017
• CVE-2016-6185 The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which might allow local users to execute arbitrarHigh 7.8 · Aug 2, 2016
• CVE-2016-2381 Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.High 7.5 · Apr 8, 2016
• CVE-2013-1667 The rehash mechanism in Perl 5.8.2 through 5.16.x allows context-dependent attackers to cause a denial of service (memory consumption and crash) via a crafted hHigh 7.5 · Mar 13, 2013
• CVE-2012-6329 The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly handle backslashes and fully qualified methoHigh 7.5 · Jan 4, 2013
• CVE-2012-5195 Heap-based buffer overflow in the Perl_repeatcpy function in util.c in Perl 5.12.x before 5.12.5, 5.14.x before 5.14.3, and 5.15.x before 15.15.5 allows contextHigh 7.5 · Dec 17, 2012
• CVE-2005-1349 Buffer overflow in Convert-UUlib (Convert::UUlib) before 1.051 allows remote attackers to execute arbitrary code via a malformed parameter to a read operation.High 7.5 · May 2, 2005