https://bugzilla.redhat.com/show_bug.cgi?id=2520642
Bug ID: 2520642
Summary: CVE-2026-13221 perl: Perl: Incorrect regular
expression processing via large regular expressions
[fedora-43]
Product: Fedora
Version: 43
Status: NEW
Whiteboard: {"flaws": ["8183e938-b12e-4634-b1d6-b734c0bbfb23"]}
Component: perl
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
CC: [email protected], [email protected],
[email protected], [email protected],
[email protected], [email protected]
Blocks: 2499727 (CVE-2026-13221)
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
Perl versions through 5.43.9 produce silently incorrect regular expression
matches when an alternation of more than 65535 fixed string branches is
compiled into a trie in Perl_study_chunk.
When such branches are combined into a trie, the delta between the first branch
and the shared tail is stored in a 16-bit field. A branch count above 65535
overflows the field, and the trie's match decision table is truncated with no
warning or error.
A pattern of this shape produces false positive matches (matching strings it
should not) and false negative matches (failing to match strings it should).
When such a pattern gates an access or filtering decision, the result is wrong.
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2499727
[Bug 2499727] CVE-2026-13221 perl: Perl: Incorrect regular expression
processing via large regular expressions
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2520642
Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-spam&short_desc=Report%20of%20Bug%202520642%23c0
--
_______________________________________________
perl-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
