CVE-2026-57433Disclosure(nwclark / storable)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch nwclark storable systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.

nwclark CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Patch / fix

Weakness type (CWE)

CWE-190

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

storable

Threat summary

Patch or workaround signal is available
4 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 4 signals
Disclosure: 3 classified signals
Peaked 2d ago at 2 mentions (2026-07-13); latest day: 1
4 total mentions across 3 days

Affected systems

Vendors

nwclark

Products

storable

Deep dive

Activity timeline4 mentions / 3d

Signal classification2 categories

Disclosure

375.0%

Patch

125.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-13	2	Disclosure2
2026-07-14	1	Disclosure1
2026-07-17	1	Patch1

Full discourse4 posts

Open Source Security mailing list@oss_security91d
Disclosure
Perl CPAN CVE-2026-57433: Storable before 3.41 have a signed integer overflow when deserializing a crafted SX_HOOK record https://www.openwall.com/lists/oss-security/2026/07/13/7 2 CVEs Crypt::OpenSSL::X509 before 2.1.3 https://www.openwall.com/lists/oss-security/2026/07/13/8 CVE-2026-58101: DoS via NULL ptr deref CVE-2026-58102: Heap OOB read
Post summary
The content announces several new CVEs with concise technical details, but does not provide PoC, exploit code, or evidence of active exploitation.
10010165
4.7K followersView on X
SecAlerts@SecAlertsCo88d
Patch
🐪 Perl's Storable module (pre-3.41) has a critical CVE-2026-57433: signed int overflow in SX_HOOK deserialization via retrieve_hook_common. CVSS 9.8, no auth needed. Upgrade to 3.41 now. https://secalerts.co/vulnerability/CVE-2026-57433?utm_campaign=x https://t.co/uWAWSIpBDi
Post summary
Perl’s Storable module (pre‑3.41) contains a high‑severity CVE‑2026‑57433 signed‑int overflow that needs no authentication; users should immediately upgrade to 3.41.
0000084
860 followersView on X
Infoflowcloud@infoflowcloud91d
Disclosure
🚨*CVE* CVE-2026-57433 Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item co… https://www.cve.org/CVERecord?id=CVE-2026-57433 ----- Traducción: CVE-2026-57433 Las… http://infoflow.cloud`
Post summary
The text announces a signed integer overflow vulnerability (CVE‑2026‑57433) in Perl’s Storable module before version 3.41, providing basic technical details but no PoC, exploit, or patch information.
0000041
92 followersView on X
CVE@CVEnew91d
Disclosure
CVE-2026-57433 Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item co… https://www.cve.org/CVERecord?id=CVE-2026-57433
Post summary
The CVE discloses a signed integer overflow in Perl's Storable module (pre‑3.41) when deserializing a crafted SX_HOOK record, but offers no evidence of exploitation or mitigation.
00000664
57.8K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	nwclark	storable	-	perl	-

Explore more

Back to dashboard nwclark CVEs storable vulnerabilities

What researchers are saying

CVE-2026-57433

Open Source Security mailing list@oss_securityDisclosure

The content announces several new CVEs with concise technical details, but does not provide PoC, exploit code, or evidence of active exploitation.

SecAlerts@SecAlertsCoPatch

Perl’s Storable module (pre‑3.41) contains a high‑severity CVE‑2026‑57433 signed‑int overflow that needs no authentication; users should immediately upgrade to 3.41.

Infoflowcloud@infoflowcloudDisclosure

The text announces a signed integer overflow vulnerability (CVE‑2026‑57433) in Perl’s Storable module before version 3.41, providing basic technical details but no PoC, exploit, or patch information.

CVE@CVEnewDisclosure

The CVE discloses a signed integer overflow in Perl's Storable module (pre‑3.41) when deserializing a crafted SX_HOOK record, but offers no evidence of exploitation or mitigation.