Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.
When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.
A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.
References
| Link | Resource |
|---|---|
| https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch | Patch |
| https://github.com/Perl/perl5/issues/23388 | Issue Tracking |
| http://www.openwall.com/lists/oss-security/2026/07/13/5 | Mailing List Patch Third Party Advisory |
Configurations
History
14 Jul 2026, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch - Patch | |
| References | () https://github.com/Perl/perl5/issues/23388 - Issue Tracking | |
| References | () http://www.openwall.com/lists/oss-security/2026/07/13/5 - Mailing List, Patch, Third Party Advisory | |
| CPE | cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:* | |
| First Time |
Perl perl
Perl |
14 Jul 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.1 |
13 Jul 2026, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
13 Jul 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-07-13 17:16
Updated : 2026-07-14 18:15
NVD link : CVE-2026-13221
Mitre link : CVE-2026-13221
CVE.ORG link : CVE-2026-13221
JSON object : View
Products Affected
perl
- perl
CWE
CWE-190
Integer Overflow or Wraparound