Skip to content
Fencer Vulns
critical 9.1

CVE-2026-13221 json

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk

published 2026-07-13 3 mo ago modified 2026-10-24 15 d ago also EUVD-2026-43503

cvss
9.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 42%
public exploits
0
none known

Summary

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.

When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.

A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.

Patch / fix

  • perl Debian 12 5.36.0-7+deb12u4
  • perl Debian 13 5.40.1-6+deb13u1
  • perl Debian 14 5.42.3-1

debian advisories DEBIAN-CVE-2026-13221

  • perl Ubuntu 22.04 LTS 5.34.0-3ubuntu1.8
  • perl Ubuntu 24.04 LTS 5.38.2-3.2ubuntu0.4
  • perl Ubuntu 26.04 LTS 5.40.1-7ubuntu0.3
  • perl Ubuntu Pro 14.04 LTS 5.18.2-2ubuntu1.7+esm8
  • perl Ubuntu Pro 16.04 LTS 5.22.1-9ubuntu0.9+esm3
  • perl Ubuntu Pro 18.04 LTS 5.26.1-6ubuntu0.7+esm3
  • perl Ubuntu Pro 20.04 LTS 5.30.0-9ubuntu0.5+esm3

ubuntu advisories UBUNTU-CVE-2026-13221

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • perl RHEL 8 4:5.32.1-475.module+el8.10.0+24767+f69b15b5
  • perl-B RHEL 8 1.80-475.module+el8.10.0+24767+f69b15b5
  • perl-if RHEL 8 0.60.800-475.module+el8.10.0+24767+f69b15b5
  • perl-IO RHEL 8 1.43-475.module+el8.10.0+24767+f69b15b5
  • perl-ph RHEL 8 5.32.1-475.module+el8.10.0+24767+f69b15b5
  • perl-Env RHEL 8 1.04-396.module+el8.10.0+21354+3ad137bb
  • perl-lib RHEL 8 0.65-475.module+el8.10.0+24767+f69b15b5
  • perl-mro RHEL 8 1.23-475.module+el8.10.0+24767+f69b15b5

red hat advisories RHSA-2026:67278RHSA-2026:67162RHSA-2026:67156RHSA-2026:67155RHSA-2026:39997

  • perl Linux Micro 6.1 5.38.2-slfo.1.1_3.1
  • perl Linux Micro 6.0 5.38.2-5.1
  • perl SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 5.42.0-160000.3.1

suse advisories SUSE-SU-2026:23075-1SUSE-SU-2026:23008-1SUSE-SU-2026:22847-1SUSE-SU-2026:22929-1

  • perl openSUSE Leap 16.0 5.42.0-160000.3.1

opensuse advisories openSUSE-SU-2026:21411-1

  • perl AlmaLinux 9 4:5.32.1-484.el9_8
  • perl-B AlmaLinux 9 1.80-484.el9_8
  • perl-if AlmaLinux 9 0.60.800-484.el9_8
  • perl-IO AlmaLinux 9 1.43-484.el9_8
  • perl-ph AlmaLinux 9 5.32.1-484.el9_8
  • perl-lib AlmaLinux 9 0.65-484.el9_8
  • perl-mro AlmaLinux 9 1.23-484.el9_8
  • perl-Net AlmaLinux 9 1.02-484.el9_8

almalinux advisories ALSA-2026:67155ALSA-2026:67156ALSA-2026:67162ALSA-2026:67278

  • perl Rocky Linux 9 4:5.32.1-484.el9_8
  • perl Rocky Linux 10 4:5.40.2-515.el10_2
  • perl Rocky Linux 8 4:5.26.3-423.el8_10.1
  • perl-Env Rocky Linux 8 1.04-396.module+el8.10.0+40155+64ce2d41
  • perl-Env Rocky Linux 8 1.04-396.module+el8.6.0+878+f93dfff7
  • perl-Env Rocky Linux 8 1.04-396.module+el8.6.0+882+2fa1e48f
  • perl-Env Rocky Linux 8 1.04-396.module+el8.10.0+1616+0d20cc68
  • perl-URI Rocky Linux 8 1.76-5.module+el8.6.0+878+f93dfff7

rocky linux advisories RLSA-2026:67155RLSA-2026:67156RLSA-2026:67162RLSA-2026:67278

  • perl Alpine 3.24 5.42.2-r1

alpine advisories ALPINE-CVE-2026-13221

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • perl Azure Linux 3.0 5.38.2-514

azure linux advisories AZL-92300

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-13221 updated cvss 5.9

perl: Perl: Incorrect regular expression processing via large regular expressions

  • Red Hat Enterprise Linux 6 perl, perl-CGI, perl-core, perl-CPAN, perl-libs, perl-parent, +39 more Red Hat Enterprise Linux 7 perl, perl-core, perl-CPAN, perl-libs, perl-tests, perl-macros, +11 more Red Hat OpenShift AI (RHOAI) rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8 Red Hat OpenShift Container Platform 5 openshift/ose-rhel-coreos-9 Red Hat OpenShift Dev Spaces devspaces/code-rhel9
    affected: no fix available
  • Red Hat Cost Management On-Premise 1 costmanagement/costmanagement-ui-rhel10 1791460851
    fixed: vendor fix RHSA-2026:79357
  • Red Hat Enterprise Linux AppStream (v. 8) perl 5.26.3-423.el8_10.1, perl-open 1.11-423.el8_10.1, perl-Test 1.30-423.el8_10.1, perl-Memoize 1.03-423.el8_10.1, perl-tests 5.26.3-423.el8_10.1, perl-utils 5.26.3-423.el8_10.1, +231 more
    fixed: vendor fix RHSA-2026:67162
  • Red Hat Enterprise Linux AppStream (v. 9) perl 5.32.1-484.el9_8, perl-B 1.80-484.el9_8, perl-IO 1.43-484.el9_8, perl-Tie 4.6-484.el9_8, perl-lib 0.65-484.el9_8, perl-mro 1.23-484.el9_8, +92 more
    fixed: vendor fix RHSA-2026:67155
  • Red Hat Enterprise Linux AppStream (v. 10) perl 5.40.2-515.el10_2, perl-B 1.89-515.el10_2, perl-IO 1.55-515.el10_2, perl-Tie 4.6-515.el10_2, perl-lib 0.65-515.el10_2, perl-mro 1.29-515.el10_2, +92 more
    fixed: vendor fix RHSA-2026:67156
  • Red Hat Enterprise Linux BaseOS (v. 8) perl 5.26.3-423.el8_10.1, perl-IO 1.38-423.el8_10.1, perl-Errno 1.28-423.el8_10.1, perl-libs 5.26.3-423.el8_10.1, perl-IO-Zlib 1.10-423.el8_10.1, perl-macros 5.26.3-423.el8_10.1, +2 more
    fixed: vendor fix RHSA-2026:67162
  • Red Hat Hardened Images perl 5.42.2-524.3.hum1, perl-B 1.89-524.3.hum1, perl-IO 1.55-524.3.hum1, perl-Tie 4.6-524.3.hum1, perl-lib 0.65-524.3.hum1, perl-mro 1.29-524.3.hum1, +93 more
    fixed: vendor fix RHSA-2026:39997
  • Red Hat OpenShift Container Platform 4.22 rhcos 4.22.9.8.202609221802
    fixed: vendor fix RHSA-2026:71446
show 2 more
  • Red Hat Update Infrastructure 5 rhui5/rhua-rhel9 1789478095
    fixed: vendor fix RHSA-2026:67956
  • Red Hat Update Infrastructure 5 rhui5/cds-rhel9 1789479900, rhui5/haproxy-rhel9 1789479891, rhui5/installer-rhel9 1789482961, rhui5/cds-kubernetes-rhel9 1789479916
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
3 mo ago

Exploit prediction

0.49% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
NVD 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CNA 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Classification

Weakness
  • CWE-190 Integer Overflow or Wraparound

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.