CVE-2026-8796Disclosure

LOWCVSS 8.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Sereal::Decoder versions before 5.005 for Perl allow heap out-of-bounds read via crafted input. In Perl/Decoder/srl_decoder.c, srl_read_object() and srl_read_hash() process a COPY tag, a back-reference whose target byte the decoder re-decodes as a fresh tag. When that target byte matches the SHORT_BINARY pattern (an inline string whose length is encoded in the low bits of the tag), the resulting read is not bounded to precede the COPY tag's own offset and can run past the end of the input buffer. An attacker controlled COPY offset can land inside a previously decoded value rather than on a tag boundary, planting a byte that the decoder reads as a SHORT_BINARY tag and consuming up to 31 following bytes from the heap as a class name (OBJECT path) or hash key (HASH path).

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-125

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

3 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
Disclosure: 2 classified signals
General: 1 classified signal
Peaked 1d ago at 2 mentions (2026-05-31); latest day: 1
3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d

Signal classification2 categories

Disclosure

266.7%

General

133.3%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-31	2	Disclosure1General1
2026-06-02	1	Disclosure1

Full discourse3 posts

Open Source Security mailing list@oss_security135d
Disclosure
Perl CPAN CVE-2026-8594: Text::LineFold through 2019.001 duplicate the output based on the number of special break characters https://www.openwall.com/lists/oss-security/2026/05/30/6 CVE-2026-8796: Sereal::Decoder before 5.005 allow heap out-of-bounds read via crafted input https://www.openwall.com/lists/oss-security/2026/06/01/1
Post summary
The tweet lists two Perl CPAN vulnerabilities with concise technical descriptions but offers no evidence of PoC, exploitation, or patch information.
00010205
4.6K followersView on X
CVE@CVEnew137d
Disclosure
CVE-2026-8796 Sereal::Decoder versions before 5.005 for Perl allow heap out-of-bounds read via crafted input. In Perl/Decoder/srl_decoder.c, srl_read_object() and srl_read_hash() pr… https://www.cve.org/CVERecord?id=CVE-2026-8796
Post summary
The text discloses a heap out-of-bounds read vulnerability in Perl’s Sereal::Decoder pre‑5.005, identifies affected functions, but lacks PoC, exploit, patch, or evidence of current exploitation.
00000182
57.6K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds137d
General
CVE-2026-8796 Heap Out-of-Bounds Read in Sereal::Decoder Before 5.005 via Crafted Input https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-8796
Post summary
The post references CVE-2026-8796, noting a heap out‑of‑bounds read in Sereal::Decoder prior to version 5.005 triggered by crafted input, but contains no evidence of an active exploit, PoC, or available fix.
0000071
4.0K followersView on X

Explore more

Back to dashboard