CVE-2026-13221: Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk
Critical 9.1 EPSS 0.5% Perl
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.
- CVE-2026-13221CVE identifier
- 9.1CVSS 3.1 base score (critical)
- 0.5%EPSS: chance of exploitation in the next 30 days (higher than 42% of CVEs)
- 2026-07-13published
What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms
What to do now
- Check whether you run Perl and which version (commands below).
- Install the fixed version for your system: see “Patch it” below.
- Restart long-running Perl daemons (e.g. spamd, amavisd, munin-node)
Affected and fixed versions
Affected:
- perl before 5.40.5-RC1
- perl 5.41.0 to before 5.42.3-RC1
- perl 5.43.0 to before 5.43.10
Patch it
Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.
Debian
sudo apt update
sudo apt install --only-upgrade perl perl-baseUbuntu
sudo apt update
sudo apt install --only-upgrade perl perl-baseRHEL, AlmaLinux, Rocky, Oracle
sudo dnf upgrade --refresh perl-interpreter perl-libsFedora
sudo dnf upgrade --refresh perl-interpreter perl-libsSUSE / openSUSE
sudo zypper refresh
sudo zypper update perl perl-baseAmazon Linux
sudo dnf upgrade --releasever=latest perl-interpreter perl-libsArch Linux
sudo pacman -SyuAlpine
apk update && apk upgrade perlFreeBSD
pkg update && pkg upgrade perl5 (lang/perl5.42; or perl5.40)General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.
Fix status in Linux distributions
| Release | Package | Status | Fixed version / advisory |
|---|---|---|---|
| Debian 12 | perl | fixed | 5.36.0-7+deb12u4 |
| Debian 13 | perl | fixed | 5.40.1-6+deb13u1 |
| Debian testing | perl | fixed | 5.42.3-1 |
| Red Hat Enterprise Linux 9 | perl-4:5.32.1-484.el9_8 | fixed | RHSA-2026:67155 |
| Red Hat Enterprise Linux 8 | perl-4:5.26.3-423.el8_10.1 | fixed | RHSA-2026:67162 |
| Red Hat Enterprise Linux 8 | perl:5.32-8100020260826134600.651ee29f | fixed | RHSA-2026:67278 |
| Red Hat Enterprise Linux 7 | perl | affected | |
| Red Hat Enterprise Linux 6 | perl | affected | |
| Red Hat Enterprise Linux 10 | perl-4:5.40.2-515.el10_2 | fixed | RHSA-2026:67156 |
From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.
Sources
- https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch
- https://github.com/Perl/perl5/issues/23388
- CVE-2026-13221 on CVE.org
- CVE-2026-13221 on NVD
Page generated automatically from official sources on 2026-11-03 18:05 UTC. Always confirm with your vendor's advisory.