perl security

CVE-2026-8450 is a high-impact reminder that a seemingly routine file-delivery helper can become an operating-system command execution primitive when older Perl semantics meet attacker-controlled input. The flaw affects HTTP::Daemon versions before 6.17 and centers on send_file, which previously...

CVE-2026-13221 can make Perl 5.38 through 5.43.9 silently return the wrong result for unusually large regular expressions, potentially breaking access controls, filtering rules, and service logic without producing an error. The flaw is fixed upstream in the Perl 5.43.10 development line and is...

CVE-2026-57432 affects Perl versions through 5.43.10, allowing a malicious pack or unpack template to trigger an integer overflow and read beyond a heap buffer. Windows administrators should inventory standalone Perl installations, Git for Windows, MSYS2, Cygwin, CI runners, and developer...

Microsoft’s Security Update Guide now lists CVE-2026-8376, a Perl vulnerability affecting versions through 5.43.10, in which 32-bit builds can suffer a heap buffer overflow while compiling regular expressions that repeat a fixed string. The bug is narrow, old-fashioned, and still worth taking...

When a tiny, widely used HTTP client slips into an insecure default mode, the consequences ripple far beyond a single library — they reach package managers, CI pipelines, internal tooling, and any application that quietly trusts “https://” without actually verifying who’s on the other end...