perl security

CVE-2026-13221 can make Perl 5.38 through 5.43.9 silently return the wrong result for unusually large regular expressions, potentially breaking access controls, filtering rules, and service logic without producing an error. The flaw is fixed upstream in the Perl 5.43.10 development line and is...

CVE-2026-57432 affects Perl versions through 5.43.10, allowing a malicious pack or unpack template to trigger an integer overflow and read beyond a heap buffer. Windows administrators should inventory standalone Perl installations, Git for Windows, MSYS2, Cygwin, CI runners, and developer...

Microsoft’s Security Update Guide now lists CVE-2026-8376, a Perl vulnerability affecting versions through 5.43.10, in which 32-bit builds can suffer a heap buffer overflow while compiling regular expressions that repeat a fixed string. The bug is narrow, old-fashioned, and still worth taking...

When a tiny, widely used HTTP client slips into an insecure default mode, the consequences ripple far beyond a single library — they reach package managers, CI pipelines, internal tooling, and any application that quietly trusts “https://” without actually verifying who’s on the other end...