CVE-2026-57432: Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.
- CVE-2026-57432CVE identifier
- 8.4CVSS 3.1 base score (high)
- 0.2%EPSS: chance of exploitation in the next 30 days (higher than 11% of CVEs)
- 2026-07-13published
What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms
What to do now
- Check whether you run Perl and which version (commands below).
- Install the fixed version for your system: see “Patch it” below.
- Restart long-running Perl daemons (e.g. spamd, amavisd, munin-node)
Affected and fixed versions
Affected:
- perl before 5.40.5-RC1
- perl 5.41.0 to before 5.42.3-RC1
- perl 5.43.0 to before 5.43.11
Patch it
Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.
Debian
sudo apt update
sudo apt install --only-upgrade perl perl-baseUbuntu
sudo apt update
sudo apt install --only-upgrade perl perl-baseRHEL, AlmaLinux, Rocky, Oracle
sudo dnf upgrade --refresh perl-interpreter perl-libsFedora
sudo dnf upgrade --refresh perl-interpreter perl-libsSUSE / openSUSE
sudo zypper refresh
sudo zypper update perl perl-baseAmazon Linux
sudo dnf upgrade --releasever=latest perl-interpreter perl-libsArch Linux
sudo pacman -SyuAlpine
apk update && apk upgrade perlFreeBSD
pkg update && pkg upgrade perl5 (lang/perl5.42; or perl5.40)General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.
Fix status in Linux distributions
| Release | Package | Status | Fixed version / advisory |
|---|---|---|---|
| Debian 12 | perl | fixed | 5.36.0-7+deb12u4 |
| Debian 13 | perl | fixed | 5.40.1-6+deb13u1 |
| Debian testing | perl | fixed | 5.40.1-8 |
| Red Hat Enterprise Linux 9 | perl | fix deferred | |
| Red Hat Enterprise Linux 8 | perl | fix deferred | |
| Red Hat Enterprise Linux 8 | perl:5.32/perl | fix deferred | |
| Red Hat Enterprise Linux 7 | perl | fix deferred | |
| Red Hat Enterprise Linux 6 | perl | fix deferred | |
| Red Hat Enterprise Linux 10 | perl | fix deferred | |
From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.
Sources
- https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch
- https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch
- CVE-2026-57432 on CVE.org
- CVE-2026-57432 on NVD
Page generated automatically from official sources on 2026-11-03 18:05 UTC. Always confirm with your vendor's advisory.