CVE-2026-13221Disclosure(perl / perl)

LOWCVSS 9.1 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch perl perl systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.

perl CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

Other references

https://github.com/Perl/perl5/issues/23388

Weakness type (CWE)

CWE-190

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

perl

Threat summary

Patch or workaround signal is available
6 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 5 signals
Disclosure: 3 classified signals
General: 2 classified signals
Peaked 3d ago at 3 mentions (2026-07-13); latest day: 1
6 total mentions across 4 days

Affected systems

Vendors

perl

Products

perl

Deep dive

Activity timeline6 mentions / 4d

Signal classification3 categories

Disclosure

350.0%

General

233.3%

Patch

116.7%

Referenced assets7 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-13	3	Disclosure2General1
2026-07-14	1	Disclosure1
2026-07-15	1	Patch1
2026-08-02	1	General1

Full discourse6 posts

Open Source Security mailing list@oss_security91d
Disclosure
CVE-2026-13221: Perl through 5.43.9 may produce silently incorrect regular expression matches https://www.openwall.com/lists/oss-security/2026/07/13/5 CVE-2026-57432: Perl through 5.43.10 have an integer overflow leading to an out-of-bounds heap read in pack and unpack https://www.openwall.com/lists/oss-security/2026/07/13/6
Post summary
Openwall announced two new Perl CVEs (CVE-2026-13221 and CVE-2026-57432) describing regex match inaccuracies and a critical integer overflow that causes an out‑of‑bounds heap read; no PoC, exploit, patch, or active exploitation report is provided.
10010177
4.7K followersView on X
CVE@CVEnew92d
Disclosure
CVE-2026-13221 Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a tri… https://www.cve.org/CVERecord?id=CVE-2026-13221
Post summary
The text discloses a Perl regex vulnerability that causes incorrect matching when handling large alternations, referencing a public CVE record.
000201.0K
58.1K followersView on X
takenaka hiroya@Joe_Biden_ja72d
General
脆弱性対応ウォッチにCVE-2026-13221を追加しました。AWS/GCP/Azure/Linuxそれぞれで今どこまで対応できるかを分けて書いています。まず自分の環境が該当するかの確認手順から読めます。 https://cve.autoarticles.net/cve/CVE-2026-13221
Post summary
The post announces the addition of CVE-2026-13221 to a vulnerability watch list and provides a link with environment‑specific check steps, but offers no further technical or exploit details.
0000056
560 followersView on X
Windows Forum@windowsforum90d
Patch
🪟 Perl’s giant regexes can silently return the wrong answer—because apparently “no error” is the perfect way to break access controls. Patch or backport before logic becomes a liability. https://windowsforum.com/threads/cve-2026-13221-fix-perl-5-38-5-43-9-regexes-return-wrong-results.438487/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #WindowsAdministration #RegularExpressions #PerlSecurity https://t.co/FHXm7v1WmP
Post summary
The tweet warns that CVE‑2026‑13221 causes Perl regexes to return incorrect results, breaking access controls, and urges users to patch or backport the fix immediately.
0000017
1.2K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds92d
General
CVE-2026-13221 Regular Expression Matching Vulnerability in Perl Versions Through 5.43.9 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-13221
Post summary
CVE-2026-13221 describes a regular expression matching bug affecting Perl versions up to 5.43.9, with only a general reference link provided and no PoC, exploit, patch, or active exploitation details.
0000091
4.1K followersView on X
Infoflowcloud@infoflowcloud92d
Disclosure
🚨*CVE* CVE-2026-13221 Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a tri… https://www.cve.org/CVERecord?id=CVE-2026-13221 ----- Traducción: CVE-2026-13221 Las… http://infoflow.cloud`
Post summary
The post announces CVE-2026-13221, a regex handling flaw in Perl up to 5.43.9, without providing any PoC, exploit, patch, or evidence of active exploitation.
0000044
92 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	perl	perl	-	-	-

Explore more

Back to dashboard perl CVEs perl vulnerabilities

What researchers are saying

CVE-2026-13221

Windows Forum[verified]@windowsforumPatch

The tweet warns that CVE‑2026‑13221 causes Perl regexes to return incorrect results, breaking access controls, and urges users to patch or backport the fix immediately.

Open Source Security mailing list@oss_securityDisclosure

Openwall announced two new Perl CVEs (CVE-2026-13221 and CVE-2026-57432) describing regex match inaccuracies and a critical integer overflow that causes an out‑of‑bounds heap read; no PoC, exploit, patch, or active exploitation report is provided.

CVE@CVEnewDisclosure

The text discloses a Perl regex vulnerability that causes incorrect matching when handling large alternations, referencing a public CVE record.

takenaka hiroya@Joe_Biden_jaGeneral

The post announces the addition of CVE-2026-13221 to a vulnerability watch list and provides a link with environment‑specific check steps, but offers no further technical or exploit details.

Vulmon Vulnerability Feed@VulmonFeedsGeneral

CVE-2026-13221 describes a regular expression matching bug affecting Perl versions up to 5.43.9, with only a general reference link provided and no PoC, exploit, patch, or active exploitation details.

Infoflowcloud@infoflowcloudDisclosure

The post announces CVE-2026-13221, a regex handling flaw in Perl up to 5.43.9, without providing any PoC, exploit, patch, or evidence of active exploitation.