Perl

Known Exploited Perl Vulnerabilities

The following Perl vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

The vulnerability CVE-2021-22204: ExifTool Remote Code Execution Vulnerability is in the top 1% of the currently known exploitable vulnerabilities.

By the Year

In 2025 there have been 2 vulnerabilities in Perl with an average score of 7.2 out of ten. Last year, in 2024 Perl had 1 security vulnerability published. That is, 1 more vulnerability have already been reported in 2025 as compared to last year. Last year, the average CVE base score was greater by 0.65

Recent Perl Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2025-40909	May 30, 2025	Perl 5.13.6 Threads CWD Race Allows Local Path Manipulation Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running. This may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit. The bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6	Perl
CVE-2024-56406	Apr 13, 2025	Heap Buffer Overflow: Perl 5.34-5.40 tr Operator (CVE-2024-56406) A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10. When there are non-ASCII bytes in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`.    $ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;'    Segmentation fault (core dumped) It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses.	Perl
CVE-2023-47039	Jan 02, 2024	Perl Windows cmd.exe Path Traversal Allows RCE A vulnerability was found in Perl. This security issue occurs while Perl for Windows relies on the system path environment variable to find the shell (`cmd.exe`). When running an executable that uses the Windows Perl interpreter, Perl attempts to find and execute `cmd.exe` within the operating system. However, due to path search order issues, Perl initially looks for cmd.exe in the current working directory. This flaw allows an attacker with limited privileges to place`cmd.exe` in locations with weak permissions, such as `C:\ProgramData`. By doing so, arbitrary code can be executed when an administrator attempts to use this executable from these compromised locations.	Perl
CVE-2023-47038	Dec 18, 2023	Heap Buffer Overflow in Perl 5.30.0 5.38.0 RegExp Compile A vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.	Perl
CVE-2023-47100	Dec 02, 2023	Unknown: RCE in Unspecified Component	Perl
CVE-2022-48522	Aug 22, 2023	In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation.	Perl
CVE-2023-31484	Apr 29, 2023	CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.	Perl
CVE-2023-31486	Apr 29, 2023	HTTP::Tiny before 0.083 HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.	Perl
CVE-2020-16156	Dec 13, 2021	CPAN 2.28 allows Signature Verification Bypass. CPAN 2.28 allows Signature Verification Bypass.	Comprehensive Perl Archive Network
CVE-2019-20919	Sep 17, 2020	An issue was discovered in the DBI module before 1.643 for Perl An issue was discovered in the DBI module before 1.643 for Perl. The hv_fetch() documentation requires checking for NULL and the code does that. But, shortly thereafter, it calls SvOK(profile), causing a NULL pointer dereference.	Dbi
CVE-2014-10402	Sep 16, 2020	An issue was discovered in the DBI module through 1.643 for Perl An issue was discovered in the DBI module through 1.643 for Perl. DBD::File drivers can open files from folders other than those specifically passed via the f_dir attribute in the data source name (DSN). NOTE: this issue exists because of an incomplete fix for CVE-2014-10401.	Dbi
CVE-2020-14393	Sep 16, 2020	A buffer overflow was found in perl-DBI < 1.643 in DBI.xs A buffer overflow was found in perl-DBI < 1.643 in DBI.xs. A local attacker who is able to supply a string longer than 300 characters could cause an out-of-bounds write, affecting the availability of the service or integrity of data.	Database Interface
CVE-2020-14392	Sep 16, 2020	An untrusted pointer dereference flaw was found in Perl-DBI < 1.643 An untrusted pointer dereference flaw was found in Perl-DBI < 1.643. A local attacker who is able to manipulate calls to dbd_db_login6_sv() could cause memory corruption, affecting the service's availability.	Database Interface
CVE-2013-7490	Sep 11, 2020	An issue was discovered in the DBI module before 1.632 for Perl An issue was discovered in the DBI module before 1.632 for Perl. Using many arguments to methods for Callbacks may lead to memory corruption.	Dbi
CVE-2020-12723	Jun 05, 2020	regcomp.c in Perl before 5.30.3 regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.	Perl
CVE-2020-10878	Jun 05, 2020	Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.	Perl
CVE-2020-10543	Jun 05, 2020	Perl before 5.30.3 on 32-bit platforms Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.	Perl
CVE-2018-18314	Dec 07, 2018	Perl before 5.26.3 has a buffer overflow via a crafted regular expression Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations.	Perl
CVE-2018-18313	Dec 07, 2018	Perl before 5.26.3 has a buffer over-read via a crafted regular expression Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory.	Perl
CVE-2018-18311	Dec 07, 2018	Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.	Perl
CVE-2018-18312	Dec 05, 2018	Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.	Perl
CVE-2018-12015	Jun 07, 2018	In Perl through 5.26.2, the Archive::Tar module In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name.	Perl
CVE-2018-6797	Apr 17, 2018	An issue was discovered in Perl 5.18 through 5.26 An issue was discovered in Perl 5.18 through 5.26. A crafted regular expression can cause a heap-based buffer overflow, with control over the bytes written.	Perl
CVE-2018-6913	Apr 17, 2018	Heap-based buffer overflow in the pack function in Perl before 5.26.2 Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count.	Perl
CVE-2018-6798	Apr 17, 2018	An issue was discovered in Perl 5.22 through 5.26 An issue was discovered in Perl 5.22 through 5.26. Matching a crafted locale dependent regular expression can cause a heap-based buffer over-read and potentially information disclosure.	Perl
CVE-2017-12883	Sep 19, 2017	Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to disclose sensitive information or cause a denial of service (application crash) via a crafted regular expression with an invalid '\N{U+...}' escape.	Perl
CVE-2017-12837	Sep 19, 2017	Heap-based buffer overflow in the S_regatom function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 Heap-based buffer overflow in the S_regatom function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to cause a denial of service (out-of-bounds write) via a regular expression with a '\N{}' escape and the case-insensitive modifier.	Perl
CVE-2015-8608	Feb 07, 2017	The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of-bounds read) and possibly execute arbitrary code via a crafted (1) drive letter or (2) pInName argument.	Perl
CVE-2016-1238	Aug 02, 2016	(1) cpan/Archive-Tar/bin/ptar (1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.	Perl
CVE-2016-6185	Aug 02, 2016	The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which might The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which might allow local users to execute arbitrary code via a Trojan horse library under the current working directory.	Perl
CVE-2016-2381	Apr 08, 2016	Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.	Perl
CVE-2015-8607	Jan 13, 2016	The canonpath function in the File::Spec module in PathTools before 3.62, as used in Perl, does not properly preserve the taint attribute of data, which might The canonpath function in the File::Spec module in PathTools before 3.62, as used in Perl, does not properly preserve the taint attribute of data, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.	Pathtools
CVE-2011-2939	Jan 13, 2012	Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow.	Perl
CVE-1999-1386	Dec 31, 1999	Perl 5.004_04 and earlier follows symbolic links when running with the -e option, which Perl 5.004_04 and earlier follows symbolic links when running with the -e option, which allows local users to overwrite arbitrary files via a symlink attack on the /tmp/perl-eaXXXXX file.	Perl