Cpan Security Advisories | Ecosyste.ms: Advisories

cpan

400 packages · metacpan.org

Security Advisories in cpan

Unspecified security issues. CPANSA-MySQL-Admin-1-1

cpan MySQL-Admin

4 days ago

Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison. The decode() method compares the supplied signature to the recomputed HMAC with Perl's eq operator, which stops at the first differing byte, so ... CPANSA-Mojo-JWT-2026-9537

cpan Mojo-JWT

4 days ago

HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date. parse_date() matches the date string against a chain of alternative regexes, and str2time() delegates to it. Several of these patterns place... CPANSA-HTTP-Date-2026-14741

cpan HTTP-Date

4 days ago

GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets. The random method creates the challenge text used for the CAPTCHA by sampling characters from an array using Perl's built-in rand function, and generates a (by default) six... CPANSA-GD-SecurityImage-2026-13082

cpan GD-SecurityImage

4 days ago

Dancer::Plugin::Auth::Google versions through 0.07 for Perl have TLS verification disabled. The default user agent is initialised with SSL_verify_mode explicitly disabled. An attacker with network man-in-the-middle (MITM) capability between the Dance... CPANSA-Dancer-Plugin-Auth-Google-2026-13410

cpan Dancer-Plugin-Auth-Google

5 days ago

XML::Bare versions through 0.53 for Perl have an unbounded character lookahead. The parserc_parse function attempts to check for multicharacter strings such as "<![CDATA" or element terminators such as ">" without checking that the offsets are within ... CPANSA-XML-Bare-2026-57074

cpan XML-Bare

5 days ago

XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes. The parserc_parse function never advances the attribute-parse state cursor on certain malformed attribute forms, looping forever. Nameless attri... CPANSA-XML-Bare-2026-13401

cpan XML-Bare

5 days ago

HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes. The parserc_parse function never advances the attribute-parse state cursor on certain malformed attribute forms, looping forever. Nameless attr... CPANSA-HTML-Bare-2026-13397

cpan HTML-Bare

5 days ago

Image::Epeg versions through 0.15 for Perl embeds an unsupported version of the Epeg library. Image::Epeg includes Epeg 0.9.0 that was last updated in 2004. Epeg is a fast JPEG thumbnail library that was once part of the Enlightenment Project. CPANSA--2026-3031

cpan Image-Epeg

5 days ago

HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead. The parserc_parse function attempts to check for multicharacter strings such as "<![CDATA" or element terminators such as ">" without checking that the offsets are within... CPANSA-HTML-Bare-2026-57073

cpan HTML-Bare

5 days ago

YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack. In the bundled libsyck, when an anchor name is redefined or removed, syck_hdlr_add_anchor and syck_hdlr_rem... CPANSA-YAML-Syck-2026-13713

cpan YAML-Syck

5 days ago

YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syck_base64dec. The base64 decoder in the bundled libsyck indexes the 256-entry static table b64_xtable with a signed char, so any !!binary by... CPANSA-YAML-Syck-2026-57075

cpan YAML-Syck

5 days ago

YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key in syck_hdlr_add_anchor. In the bundled libsyck an anchor name allocated by syck_strndup is stored both as node->anchor, freed when ... CPANSA-YAML-Syck-2026-57076

cpan YAML-Syck

5 days ago

YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len. In the bundled libsyck newline_len and is_newline dereference the scan pointer, and the following byte for a "\r\n" pair, with no NUL-te... CPANSA-YAML-Syck-2026-57077

cpan YAML-Syck

7 days ago

DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text. DBI::SQL::Nano, DBI's built-in mini-SQL engine, evaluated WHERE predicates incorrectly in some cases. In the non-numeric string branch of the is_mat... CPANSA-DBI-2026-15043

cpan DBI

7 days ago

DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row. When the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index. This could b... CPANSA-DBI-2026-60082

cpan DBI

7 days ago

DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location. The complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the... CPANSA-DBI-2026-15392

cpan DBI

7 days ago

DBI::ProfileData versions before 1.651 for Perl do not limit the path index. The path index column of profile dump files is used to allocate an array of data for the parser. An unbounded value allows an attacker to specify a large index and consume av... CPANSA-DBI-2026-60081

cpan DBI

7 days ago

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle. _csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_fie... CPANSA-Mojolicious-2026-15747

cpan Mojolicious

8 days ago

Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow a heap out-of-bounds read via a long certificate extension OID in hv_exts. When building the extension hash (via extensions(), extensions_by_long_name(), extensions_by_oid(), or has_extension_o... CPANSA-Crypt-OpenSSL-X509-2026-58102

cpan Crypt-OpenSSL-X509

8 days ago

Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between... CPANSA-perl-2026-13221

cpan perl

8 days ago

Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I3... CPANSA-Storable-2026-57433

cpan Storable

8 days ago

Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow denial of service via NULL pointer dereference. X509V3_EXT_d2i(ext) returns NULL when an extension's DER value fails to parse. basicC, ia5string, and auth_att dereference its result without a N... CPANSA-Crypt-OpenSSL-X509-2026-58101

cpan Crypt-OpenSSL-X509

8 days ago

Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large re... CPANSA-perl-2026-57432

cpan perl

13 days ago

Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed. Imager mishandled large EXIF IFD entry count values, treating them as negative numbers. This could lead to an attempt to allocate a block nearly the size of the add... CPANSA-Imager-2026-14454

cpan Imager

13 days ago

App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences from filenames in several output modes. When ack prints a filename whose basename contains terminal control bytes such as ANSI escape sequences, those bytes reach th... CPANSA-ack-2026-49147

cpan ack

13 days ago

App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context value in a project .ackrc. ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The -B and -C context o... CPANSA-ack-2026-49146

cpan ack

13 days ago

App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc. ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The project-source option blocklist in ... CPANSA-ack-2026-49145

cpan ack

14 days ago

DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders. The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders. DBI version 1.6... CPANSA-DBI-2026-14739

cpan DBI

14 days ago

HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `heade... CPANSA-HTTP-Tiny-2026-7017

cpan HTTP-Tiny

14 days ago

DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a st... CPANSA-DBI-2026-14380

cpan DBI

14 days ago

Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded. Module names starting with "::" could be passed to the load function to specify arbitrary module paths. Attackers able to influence module names passed t... CPANSA-Module-Load-2011-10043

cpan Module-Load

14 days ago

String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service. The trim and rtrim functions stripped trailing whitespace with s/\s$//u. Because \s matches greedily and the $ anchor fails whenever a non-whitespa... CPANSA-String-Util-2026-14895

cpan String-Util

14 days ago

DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment. The preparse method normalises SQL and removes comments. When the SQL starts with a comment line, the deletion of that line during normali... CPANSA-DBI-2026-14740

cpan DBI

15 days ago

Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder. The pure-Perl decode path (`_decode_value` dispatching to `_decode_array` and `_decode_object`) recurses with no depth limit, so a small... CPANSA-Mojolicious-2026-14803

cpan Mojolicious

15 days ago

Imager::File::JPEG versions before 1.003 for Perl leak heap memory when reading a JPEG with repeated APP13 markers in i_readjpeg_wiol. i_readjpeg_wiol walks the marker list libjpeg returns and, for each APP13 marker, allocates a new buffer with *iptc_... CPANSA-Imager-File-JPEG-2026-13708

cpan Imager-File-JPEG

15 days ago

Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bundled Imager::File::SGI reader via a 16-bit RLE literal run in read_rgb_16_rle. read_rgb_16_rle guards each literal run with if (count > data_left), but count is a pixel cou... CPANSA-Imager-2026-13705

cpan Imager

16 days ago

Crypt::DSA versions before 1.22 for Perl draw the DSA signing nonce and private key from a biased random generator, leading to private-key recovery. "Crypt::DSA::Util::makerandom forces the high bit of every value it returns to obtain an exactly N-bit... CPANSA-Crypt-DSA-2026-14570

cpan Crypt-DSA

17 days ago

Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth 2.0 state parameter. RequestTokenV2 builds the provider authorization redirect without issuing a state value, and AccessTokenV2 exchanges the callback code and registers ... CPANSA-Plack-Middleware-OAuth-2026-12740

cpan Plack-Middleware-OAuth

17 days ago

Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not support the OAuth 2.0 state parameter. The authentication_url method builds the provider authorization redirect without issuing a state value, and the callback method exchange... CPANSA-Dancer2-Plugin-Auth-OAuth-2026-12746

cpan Dancer2-Plugin-Auth-OAuth

18 days ago

Net::IP::LPM versions through 1.10 for Perl allow a heap out-of-bounds read via an unbounded prefix length. add() passes the prefix string to the trie builder addPrefixToTrie() without checking it against the address width. addPrefixToTrie() then wal... CPANSA-Net-IP-LPM-2026-56015

cpan Net-IP-LPM

20 days ago

CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources. The generate_id method builds the session id from a MD5 digest of the process id, the epoch time, and the built-in rand() function. All thre... CPANSA-CGI-Session-2026-56016

cpan CGI-Session

20 days ago

HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion. Support for the <template> element was added to libgumbo 0.10.0 in 2015, but the walk_tree function in lib/HTML/Gumbo.xs was not updated to support it. The element was ... CPANSA-HTML-Gumbo-2025-15646

cpan HTML-Gumbo

21 days ago

DBIx::QuickORM versions before 0.000026 for Perl allow SQL injection via unquoted SQL identifiers. The default SQL builder, a SQL::Abstract subclass, sets bindtype in its constructor but never quote_char, so SQL::Abstract emits identifiers verbatim. C... CPANSA-DBIx-QuickORM-2026-13766

cpan DBIx-QuickORM

21 days ago

Net::BitTorrent versions through 2.0.1 for Perl generate the MSE Diffie-Hellman private key with a non-cryptographic PRNG. The MSE (Message Stream Encryption) handshake derives its 160-bit Diffie-Hellman private key from Perl's rand(), a non-cryptogra... CPANSA-Net-BitTorrent-2026-57082

cpan Net-BitTorrent

21 days ago

Net::BitTorrent versions through 2.0.1 for Perl allow remote memory exhaustion via deeply nested bencoded input. bdecode recurses once per nested list or dictionary level with no depth cap, and each recursive call receives the remaining buffer by valu... CPANSA-Net-BitTorrent-2026-57081

cpan Net-BitTorrent

21 days ago

Net::BitTorrent versions through 2.0.1 for Perl allow remote memory exhaustion via an uncapped peer-wire message-length prefix. The peer-wire framing in _process_messages trusts the 4-byte length prefix sent by a connected peer with no upper bound, wh... CPANSA-Net-BitTorrent-2026-57080

cpan Net-BitTorrent

21 days ago

Net::BitTorrent versions through 2.0.1 for Perl write files outside the download directory via path traversal in peer-supplied metadata. Net::BitTorrent validates file path components only on the .torrent-file ingest path. The peer and magnet metadata... CPANSA-Net-BitTorrent-2026-57079

cpan Net-BitTorrent

22 days ago

JavaScript::Minifier::XS versions before 0.16 for Perl crash with a NULL pointer dereference when the first meaningful token of the input is a slash. The regexp versus division disambiguator in JsTokenizeString (XS.xs) inspects the previous token's la... CPANSA-JavaScript-Minifier-XS-2026-56017

cpan JavaScript-Minifier-XS

22 days ago

CSS::Minifier::XS versions before 0.14 for Perl have a memory leak when the entire document is minified away. The minify function has a memory leak when processing a document containing only characters to be removed, such as comments and whitespace. CPANSA-CSS-Minifier-XS-2026-13593

cpan CSS-Minifier-XS

22 days ago

JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unbounded memory growth. In JsMinify (XS.xs) the cleanup frees only the NodeSet structures and never the per-token contents buffers allocated in JsS... CPANSA-JavaScript-Minifier-XS-2026-56018

cpan JavaScript-Minifier-XS

22 days ago

CryptX versions before 0.088_001 for Perl compare AEAD authentication tags in non-constant time in the streaming decrypt_done path. The decrypt_done($tag) form compares it against the computed tag with memNE (memcmp() != 0), which short-circuits on th... CPANSA-CryptX-2026-13758

cpan CryptX

25 days ago

Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes. When an object is initialised before forking, or when the functional interface is used, then the internal state for the PRNG is shared across processes ... CPANSA-Bytes-Random-Secure-2026-11625

cpan Bytes-Random-Secure

25 days ago

Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes. When an object is initialised before forking, then the internal state for the PRNG is shared across processes and identical random streams will b... CPANSA-Bytes-Random-Secure-Tiny-2026-11702

cpan Bytes-Random-Secure-Tiny

26 days ago

List::SomeUtils::XS versions before 0.59 for Perl have a heap buffer overflow in the pairwise function. pairwise() collects the values returned by the block into a heap buffer sized to the longer input array, then grows the buffer before each copy wit... CPANSA-List-SomeUtils-XS-2026-12844

cpan List-SomeUtils-XS

28 days ago

Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter. When no state generator is specified in the constructor, the module defaults to using a SHA-1 hash of predictable and low-entropy sources, ... CPANSA-Mojolicious-Plugin-Web-Auth-2026-9733

cpan Mojolicious-Plugin-Web-Auth

29 days ago

Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections. Net::Statsite::Client is a client for the statsite protocol, which is a variant of statsd. Newlines are not removed from metric names, allowing metric injections. Values ... CPANSA-Net-Statsite-Client-2026-11373

cpan Net-Statsite-Client

about 1 month ago

Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OOB read in print_attribute UTF8STRING path. print_attribute() copies a UTF8STRING ASN.1 attribute value into a heap buffer sized exactly to its declared length via strncpy, leaving n... CPANSA-Crypt-OpenSSL-PKCS12-2026-9265

cpan Crypt-OpenSSL-PKCS12

about 1 month ago

Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurely. The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, the heap address of an anonymous hash, and th... CPANSA-Mojolicious-Plugin-SessionStore-2026-9692

cpan Mojolicious-Plugin-SessionStore

about 1 month ago

Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiad... CPANSA-Socket-2026-12087

cpan Socket

about 1 month ago

Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce. The default nonce was generated using an MD5 hash of the epoch time, which is predictable. CPANSA-Dancer2-Plugin-Auth-OAuth-2026-11832

cpan Dancer2-Plugin-Auth-OAuth

about 1 month ago

Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery. Crypt::DSA::sign caches the per-signature nonce material in the Key object without ever clearing it. The first sign() on a Key object picks ... CPANSA-Crypt-DSA-2026-12205

cpan Crypt-DSA

about 1 month ago

GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandle. GD::Image::_make_filehandle opens a filename argument with Perl's 2-arg open(), so a filename that begins or e... CPANSA-GD-2026-11526

cpan GD

about 1 month ago

Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open() of the -file argument in _make_filehandle. Config::IniFiles::_make_filehandle opens a filename argument with Perl's 2-arg open(), so a ... CPANSA-Config-IniFiles-2026-11527

cpan Config-IniFiles

about 1 month ago

Crypt::PBKDF2 versions before 0.261630 for Perl generate insecure random values for salts. These versions use the built-in rand function, which is predictable and unsuitable for cryptography. CPANSA-Crypt-PBKDF2-2026-9638

cpan Crypt-PBKDF2

about 1 month ago

Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks. These versions use Perl's built-in eq comparison. Discrepancies in timing could be used to guess the underlying derived-key. CPANSA-Crypt-PBKDF2-2017-20240

cpan Crypt-PBKDF2

about 1 month ago

Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations. The default algorithm is HMAC-SHA1, which should only be used for legacy systems. These versions default to using 1000 iterations. Depending on t... CPANSA-Crypt-PBKDF2-2026-9641

cpan Crypt-PBKDF2

about 1 month ago

Metrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injections. The statsd protocol (and extensions) allow mutiple metrics, separated by newlines, to be sent per packet. The send method does not validate the co... CPANSA-Metrics-Any-Adapter-Statsd-2026-50637

cpan Metrics-Any-Adapter-Statsd

about 1 month ago

Metrics::Any::Adapter::SignalFx versions before 0.04 for Perl does not protect against metric injections. The statsd protocol (and extensions such as dogstatsd) allow mutiple metrics, separated by newlines, to be sent per packet. Metrics::Any::Adapte... CPANSA-Metrics-Any-Adapter-Statsd-2026-50639

cpan Metrics-Any-Adapter-Statsd

about 1 month ago

Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injections. The statsd protocol (and extensions such as dogstatsd) allow mutiple metrics, separated by newlines, to be sent per packet. Metrics::Any::Adapt... CPANSA-Metrics-Any-Adapter-Statsd-2026-50638

cpan Metrics-Any-Adapter-Statsd

about 1 month ago

Catalyst::Plugin::Authentication versions before 0.10_027 for Perl is susceptible to session fixation attacks. Catalyst::Plugin::Authentication does not automatically change the session id after authentication. An attacker that obtains a session id co... CPANSA-Catalyst-Plugin-Authentication-2009-10007

cpan Catalyst-Plugin-Authentication

about 1 month ago

DBI versions before 1.648 for Perl saved errors in a limited-sized buffer. Error messages that were returned when RaiseError, PrintError or HandleError were set were written to a 200-byte buffer without a length limit. Attackers that can influence th... CPANSA-DBI-2026-9698

cpan DBI

about 2 months ago

Protocol::HTTP2 versions through 1.12 for Perl is vulnerable to a HTTP/2 Bomb. Protocol::HTTP2's inbound HPACK path has no header-list size limit, so a small HTTP/2 request can expand into large server memory (the "HTTP/2 bomb"). The headers_decode m... CPANSA-Protocol-HTTP2-2026-10725

cpan Protocol-HTTP2

about 2 months ago

DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders. The preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder... CPANSA-DBI-2026-10879

cpan DBI

about 2 months ago

DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags. DataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources. The format_event method (used by the event meth... CPANSA-DataDog-DogStatsd-2026-11362

cpan DataDog-DogStatsd

about 2 months ago

DataDog::DogStatsd versions through 0.07 for Perl allow metric injections. DataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources. The send_stats method does not remove newlines from metric name... CPANSA-DataDog-DogStatsd-2026-9270

cpan DataDog-DogStatsd

about 2 months ago

HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities. The XS routine backing HTML::Entities::_decode_entities cached a pointer (repl) into the entity-value SV returned by hv_fetch on the entity2char hash. When the in... CPANSA-HTML-Parser-2026-8829

cpan HTML-Parser

about 2 months ago

Net::Async::Statsd::Client versions through 0.005 for Perl allow metric injections. The metric names are not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics. CPANSA-Net-Async-Statsd-2026-8722

cpan Net-Async-Statsd

about 2 months ago

Net::CIDR::Set versions through 0.20 for Perl did not validate network masks. The mask portion of a network mask could contain Unicode digits such as the Arabic-Indic One (U+0661), or non-digits, which were ignored. This could allow network masks to... CPANSA-Net-CIDR-Set-2026-49942

cpan Net-CIDR-Set

about 2 months ago

Net::CIDR::Set versions through 0.20 for Perl did not validate IP addresses. The add method called the _encode method to parse addresses. If the addresses did not look like netmasks or network ranges, then they were assumed to single IP addresses and ... CPANSA-Net-CIDR-Set-2026-49941

cpan Net-CIDR-Set

about 2 months ago

Net::CIDR::Set versions through 0.20 for Perl accept non-ASCII IP addresses and netmasks. Unicode digits such as the Arabic-Indic One (U+0661) were accepted but not properly parsed as numbers. This could allow network masks to accept larger networks. CPANSA-Net-CIDR-Set-2026-49940

cpan Net-CIDR-Set

about 2 months ago

Etsy::StatsD versions through 1.002002 for Perl allow metric injections. The metric names and values are not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics. Note that the git rep... CPANSA-Etsy-StatsD-2026-46741

cpan Etsy-StatsD

about 2 months ago

Net::Statsd versions before 0.13 for Perl allow metric injections. The metric names are not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics. The update_stats (used for updating co... CPANSA-Net-Statsd-2026-46739

cpan Net-Statsd

about 2 months ago

Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decode_json() advances the input scalar's string pointer past the mark with S... CPANSA-Cpanel-JSON-XS-2026-9516

cpan Cpanel-JSON-XS

about 2 months ago

Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled. decode_hv() collapses duplicate object keys into an array reference under dupkeys_as_arrayref. The branch reached for a ... CPANSA-Cpanel-JSON-XS-2026-9334

cpan Cpanel-JSON-XS

about 2 months ago

Sereal::Decoder versions before 5.005 for Perl allow heap out-of-bounds read via crafted input. In Perl/Decoder/srl_decoder.c, srl_read_object() and srl_read_hash() process a COPY tag, a back-reference whose target byte the decoder re-decodes as a fre... CPANSA--2026-8796

cpan Sereal-Decoder

about 2 months ago

Text::LineFold versions through 2019.001 for Perl duplicate the output based on the number of special break characters. Text::LineFold splits the input string by specific line break characters (such as VT, FF and others) into segments, but applies the... CPANSA-Unicode-LineBreak-2026-8594

cpan Unicode-LineBreak

about 2 months ago

Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths. The header injection rule was ineffective at blocking header injections in the request paths unless they were double-encoded, for exa... CPANSA-Plack-Middleware-Security-Simple-2026-9658

cpan Plack-Middleware-Security-Simple

about 2 months ago

CryptX versions before 0.088_001 for Perl have a stack buffer overflow in four AEAD decrypt_verify helpers. The gcm_decrypt_verify, ccm_decrypt_verify, chacha20poly1305_decrypt_verify and eax_decrypt_verify XS routines copied the caller-supplied authe... CPANSA-CryptX-2026-41565

cpan CryptX

about 2 months ago

HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file(). send_file() opens its string argument with Perl's 2-arg open(). The 2-arg form interprets magic prefixes: '| cmd' and 'cmd |' open a pipe to a subprocess, '> path' ... CPANSA-HTTP-Daemon-2026-8450

cpan HTTP-Daemon

about 2 months ago

IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward. fastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c ... CPANSA-IO-Compress-2026-48959

cpan IO-Compress

about 2 months ago

IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date. _dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without a... CPANSA-IO-Compress-2025-15649

cpan IO-Compress

about 2 months ago

IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob. _parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _get... CPANSA-IO-Compress-2026-48962

cpan IO-Compress

about 2 months ago

IO::Compress versions from 2.207 before 2.220 for Perl ship a zipdetails CLI tool that crashes with undefined subroutine on Info-ZIP Unix Extra Field with 8-byte UID or GID. When decode_ux() in bin/zipdetails handles an Info-ZIP Unix Extra Field (tag ... CPANSA-IO-Compress-2026-48961

cpan IO-Compress

about 2 months ago

Crypt::ScryptKDF versions through 0.010 for Perl uses insecure random number source when no CSPRNG module is available. The random_bytes function fell back to using the built-in rand() function when none of the Perl modules Crypt::PRNG, Crypt::OpenSSL... CPANSA-Crypt-ScryptKDF-2026-8647

cpan Crypt-ScryptKDF

about 2 months ago

Mojolicious::Plugin::Statsd versions through 0.04 for Perl allowed metric injections. The metric names and set values were not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inject additional statsd metrics. Ver... CPANSA-Mojolicious-Plugin-Statsd-2026-46740

cpan Mojolicious-Plugin-Statsd

about 2 months ago

Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than b... CPANSA-perl-2026-8376

cpan perl

about 2 months ago

Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory. _make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, cr... CPANSA-Archive-Tar-2026-42497

cpan Archive-Tar

about 2 months ago

Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segmen... CPANSA-Archive-Tar-2026-42496

cpan Archive-Tar

about 2 months ago

Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header. _read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size... CPANSA-Archive-Tar-2026-9538

cpan Archive-Tar

Filter by Severity

Moderate 210 High 101 Critical 49 Low 6

Filter by Package

perl 47 DBD-SQLite 42 MT 37 Mojolicious 20 DBI 18 Yukki 14 Dpkg 14 MySQL-Admin 13 Kossy 11 Zonemaster-GUI 11 YATT-Lite 10 Zabbix-Reporter 10 SockJS 10 UR 10 App-Netdisco 10 Ukigumo-Server 10 Yancy 10 Squatting 9 Imager 9 Plack-Debugger 9 Resource-Pack-jQuery 9 Stardust 9 Sidef 9 Yote 9 JS-jQuery 9 DBD-mysql 7 Net-Dropbear 7 YAML-Syck 7 CGI 6 File-Path 6 Archive-Tar 6 libwww-perl 6 Cpanel-JSON-XS 6 CryptX 6 Sereal-Decoder 5 Win32-File-Summary 5 Git-Raw 5 Crypt-DSA 5 IO-Compress 5 Net-CIDR-Lite 5 HTTP-Tiny 5 ActivePerl 5 Net-CIDR-Set 4 Tk 4 Alien-SVN 4 Sereal-Encoder 4 Git-XS 4 CGI-Simple 4 Plack 4 Compress-Raw-Zlib 4 Archive-Unzip-Burst 4 Lemonldap-NG-Portal 4 Net-BitTorrent 4 Jifty 4 YAML-LibYAML 4 CPAN 3 mod_perl 3 Apache-Session 3 Dancer 3 Crypt-OpenSSL-PKCS12 3 XML-LibXML 3 Metrics-Any-Adapter-Statsd 3 Net-SNMP 3 Safe 3 CGI-Session 3 Crypt-Sodium-XS 3 Lemonldap-NG-Handler 3 Storable 3 Config-Model 3 DBD-Pg 3 Lemonldap-NG-Manager 3 Crypt-PBKDF2 3 ack 3 UI-Dialog 3 Lemonldap-NG-Common 3 Image-ExifTool 3 Plack-Middleware-Session 3 DBD-MariaDB 3 Crypt-CBC 3 Encode 3 Net-DNS 3 GBrowse 3 SOAP-Lite 3 Perl6-Pugs 3 PAR 2 App-cpanminus 2 BSON-XS 2 Socket 2 Config-IniFiles 2 HTML-Parser 2 EasyTCP 2 POSIX-2008 2 HTML-Bare 2 DBIx-Class-EncodedColumn 2 Mozilla-CA 2 App-revealup 2 Dancer2-Plugin-Auth-OAuth 2 cppAdaptive2 2 DataDog-DogStatsd 2 XML-Bare 2 HTTP-Session2 2 Plack-Middleware-Statsd 2 Boost-Graph 2 Crypt-NaCl-Sodium 2 Net-IP-LPM 2 HarfBuzz-Shaper 2 MHonArc 2 Win32-Printer 2 Crypt-Perl 2 Alien-FreeImage 2 Crypt-SaltedHash 2 Compress-Raw-Bzip2 2 GD 2 Digest 2 Email-Address 2 Locale-Maketext 2 Perl-Tidy 2 Net-Statsd-Lite 2 JavaScript-Minifier-XS 2 Crypt-Random 2 Archive-Zip 2 XML-Parser 2 Crypt-OpenSSL-X509 2 Spreadsheet-ParseXLSX 2 Net-OpenID-Consumer 2 Apache-Session-Browseable 2 IO-Socket-SSL 2 Catalyst-Runtime 2 HTTP-Daemon 2 Tcl 2 YAML 2 Zonemaster-Backend 2 Catalyst-Plugin-Authentication 2 cppAdaptive1 2 FCGI 2 PathTools 2 XML-Atom 1 JavaScript-Duktape 1 CPAN-Checksums 1 IPC-Run 1 Unicode-LineBreak 1 JSON-XS 1 Starman 1 CGI-Application-Plugin-AutoRunmode 1 WWW-UsePerl-Server 1 Apache-Wyrd 1 Imager-File-GIF 1 Net-IPv4Addr 1 Plack-Middleware-XSRFBlock 1 Gazelle 1 Amon2 1 Amon2-Plugin-Web-CSRFDefender 1 RPC-XML 1 eperl 1 Crypt-RandomEncryption 1 Mojo-DOM-Role-Analyzer 1 Mail-Audit 1 Graphics-ColorNames 1 Dancer2 1 Catalyst-Controller-Combine 1 PAR-Packer 1 Devel-StackTrace 1 ExtUtils-MakeMaker 1 Sub-HandlesVia 1 Crypt-SysRandom-XS 1 SVG-Sparkline 1 Apache2-API 1 App-Github-Email 1 Cmd-Dwarf 1 XML-Simple 1 Protocol-HTTP2 1 Search-OpenSearch-Server 1 WWW-Mechanize-Cached 1 Image-Info 1 MARC-File-XML 1 Otogiri 1 Term-ReadLine-Gnu 1 File-Temp 1 Pinto 1 Module-Load 1 LWP-Protocol-Net-Curl 1 Crypt-Primes 1 Bytes-Random-Secure 1 String-Compare-ConstantTime 1 Catalyst-Plugin-Session 1 Net-Statsite-Client 1 Crypt-OpenSSL-RSA 1 Alien-PCRE2 1 Data-FormValidator 1 Clipboard 1 XML-Twig 1 Mojolicious-Plugin-Web-Auth 1 Text-CSV_XS 1 Redis-Fast 1 Crypt-OpenSSL-DSA 1 Authen-SASL 1 Apache-AuthCAS 1 perl-ldap 1 Apache-SessionX 1 Amazon-Credentials 1

Filter by Repository

https://github.com/jquery/jquery 108 https://github.com/Perl/perl5 26 https://github.com/sqlite/sqlite 15 https://github.com/mojolicious/mojo 14 https://github.com/perl5-dbi/dbi 13 https://github.com/twbs/bootstrap 9 https://github.com/perl5-dbi/DBD-mysql 7 https://github.com/briandfoy/cpan-security-advisory 6 https://github.com/tonycoz/imager 6 https://github.com/rurban/Cpanel-JSON-XS 6 https://sourceforge.net/projects/sourceforge.net 6 https://github.com/madler/zlib 6 https://github.com/glennrp/libpng 6 https://github.com/jib/archive-tar-new 5 https://github.com/stigtsp/Net-CIDR-Lite 5 https://github.com/DCIT/perl-CryptX 4 https://github.com/facebook/zstd 4 https://github.com/sanko/Net-BitTorrent.pm 4 https://github.com/toddr/YAML-Syck 4 https://github.com/pmqs/IO-Compress 4 https://github.com/jquery/jquery-ui 3 https://github.com/libtom/libtomcrypt 3 https://github.com/cpan-authors/YAML-Syck 3 https://github.com/dod38fr/config-model 3 https://github.com/redis/hiredis 3 https://github.com/libgit2/security 3 https://github.com/kmx/alien-freeimage 3 https://github.com/Perl-Toolchain-Gang/HTTP-Tiny 2 https://github.com/libtom/libtommath 2 https://github.com/miyagawa/cpanminus 2 https://github.com/nanoscopic/perl-HTML-Bare 2 https://github.com/chartjs/Chart.js 2 https://github.com/cpan-authors/XML-Parser 2 https://github.com/dsully/perl-crypt-openssl-x509 2 https://github.com/LemonLDAPNG/Apache-Session-Browseable 2 https://github.com/richgel999/miniz 2 https://github.com/ingydotnet/yaml-pm 2 https://github.com/FGasper/p5-Crypt-Perl 2 https://github.com/dsully/perl-crypt-openssl-pkcs12 2 https://github.com/PerlDancer/Dancer 2 https://github.com/libwww-perl/libwww-perl 2 https://github.com/cpan-authors/crypt-nacl-sodium 2 https://github.com/perl-catalyst/Catalyst-Plugin-Authentication 2 https://github.com/tokuhirom/HTTP-Session2 2 https://github.com/robrwo/perl-Crypt-SaltedHash 2 https://github.com/nanoscopic/perl-XML-Bare 2 https://github.com/exiftool/exiftool 2 https://github.com/ingydotnet/yaml-libyaml-pm 2 https://github.com/chansen/p5-http-tiny 2 https://github.com/blog/1938-git-client-vulnerability-announced 2 https://github.com/robrwo/Plack-Middleware-Statsd 2 https://github.com/zonemaster/zonemaster-backend 2 https://github.com/andk/cpanpm 2 https://github.com/svaarala/duktape 2 https://github.com/mitmproxy/pdoc 2 https://github.com/AndyA/CGI--Simple 2 https://github.com/libwww-perl/HTTP-Daemon 2 https://github.com/hashcat/hashcat 2 https://github.com/jedisct1/libsodium 2 https://github.com/DCIT/perl-Crypt-JWT 1 https://github.com/beyondgrep/ack3 1 https://bitbucket.org/xi/libyaml 1 https://github.com/exodist/DBIx-QuickORM 1 https://github.com/gwadej/svg-sparkline 1 https://github.com/karpet/search-opensearch-server 1 https://github.com/grantm/xml-simple 1 https://github.com/tokuhirom/Amon 1 https://github.com/miyagawa/Starman 1 https://bitbucket.org/shlomif/perl-config-inifiles 1 https://github.com/jkeenan/File-Path 1 https://github.com/pjuhasz/JSON-SIMD 1 https://github.com/Leont/crypt-argon2 1 https://github.com/redhotpenguin/perl-soaplite 1 https://github.com/harfbuzz/harfbuzz 1 https://github.com/daoswald/Bytes-Random-Secure-Tiny 1 https://github.com/c9s/Plack-Middleware-OAuth 1 https://github.com/kazeburo/Plack-Middleware-Session-Simple 1 https://github.com/rschupp/Module-ScanDeps 1 https://github.com/bleargh45/JavaScript-Minifier-XS 1 https://github.com/yuki-kimoto/DBIx-Custom 1 https://github.com/seagirl/dwarf 1 https://github.com/karenetheridge/Crypt-Random-Source 1 https://github.com/svarshavchik/Net-CIDR 1 https://github.com/atoomic/Crypt-Primes 1 https://github.com/Perl-Toolchain-Gang/ExtUtils-MakeMaker 1 https://github.com/Dual-Life/Devel-PPPort 1 https://github.com/dajobe/raptor 1 https://github.com/daoswald/Bytes-Random-Secure 1 https://github.com/perl-catalyst/Catalyst-Plugin-Session 1 https://github.com/richardc/perl-file-find-rule 1 https://github.com/shlomif/perl-Config-IniFiles 1 https://github.com/libwww-perl/lwp-protocol-https 1 https://github.com/josdejong/jsoneditor 1 https://github.com/amaltsev/XAO-Web 1 https://github.com/kazeburo/Kossy 1 https://github.com/ycdxsb/WindowsPrivilegeEscalation 1 https://github.com/hatukanezumi/Unicode-LineBreak 1 https://github.com/perl-net-saml2/perl-XML-Sig 1 https://github.com/robrwo/perl-Mojolicious-Plugin-Statsd 1 https://github.com/libwww-perl/HTML-Parser 1 https://github.com/houseabsolute/Data-Validate-IP 1 https://github.com/dagolden/Capture-Tiny 1 https://github.com/gitpan/PerlSpeak 1 https://github.com/LemonLDAPNG/Apache-Session-LDAP 1 https://github.com/FastCGI-Archives/fcgi2 1 https://github.com/jmcnamara/spreadsheet-parseexcel 1 https://github.com/haile01/perl_spreadsheet_excel_rce_poc 1 https://github.com/karpet/Dezi 1 https://github.com/angular/angular.js 1 https://github.com/libwww-perl/HTTP-Date 1 https://github.com/perl-Crypt-OpenPGP/Crypt-Random 1 https://github.com/thaljef/Pinto 1 https://github.com/gbarr/perl-Convert-ASN1 1 https://github.com/Sereal/Sereal 1 https://github.com/robrwo/CatalystX-Statsd 1 https://github.com/plack/Plack-Middleware-Session 1 https://sourceforge.net/projects/net-snmp 1 https://github.com/gray/compress-lz4 1 https://github.com/sgnix/kelp 1 https://github.com/bluefeet/GitLab-API-v4 1 https://github.com/cpan-authors/Text-CSV_XS 1 https://github.com/cpan-authors/XML-LibXML 1 https://github.com/atoomic/Crypt-Random 1 https://github.com/mtrmac/IPTables-Parse 1 https://github.com/preaction/Log-Any 1 https://github.com/snapappointments/bootstrap-select 1 https://github.com/robrwo/Net-Statsd-Lite 1 https://github.com/perltidy/perltidy 1 https://github.com/clintongormley/perl-html-stripscripts 1 https://github.com/robrwo/Net-Statsd-Tiny 1 https://github.com/Perl-Toolchain-Gang/File-Temp 1 https://github.com/kazuho/Starlet 1 https://github.com/perl-catalyst/Catalyst-Authentication-Credential-HTTP 1 https://github.com/jberger/Galileo 1 https://github.com/plack/Plack 1 https://sourceforge.net/projects/enlightenment 1 https://github.com/abw/Template2 1 https://github.com/robrwo/perl-Net-CIDR-Set 1 https://github.com/markstos/CGI--Application 1 https://github.com/lstein/Lib-Crypt-CBC 1 https://github.com/PerlDancer/Dancer2 1 https://github.com/gnustavo/SVN-Look 1 https://github.com/bwva/Concierge-Sessions 1 https://github.com/google/brotli 1 https://github.com/bluefeet/Starch 1 https://github.com/gisle/html-parser 1 https://github.com/lstein/Perl-GD 1 https://github.com/tchatzi/Authen-TOTP 1 https://github.com/toddr/Crypt-OpenSSL-RSA 1 https://github.com/cosimo/perl5-net-statsd 1 https://github.com/houseabsolute/List-SomeUtils-XS 1 https://github.com/kberov/Ado 1 https://github.com/certifi/python-certifi 1 https://github.com/zhuowei/worthdoingbadly.com 1 https://github.com/rjbs/Email-MIME 1 https://github.com/gbarr/perl-authen-sasl 1 https://github.com/xsawyerx/app-genpass 1 https://github.com/hakimel/reveal.js 1 https://github.com/cromedome/cgi-application-plugin-captcha 1 https://github.com/dankogai/p5-encode 1 https://github.com/marcusramberg/Mojolicious-Plugin-OAuth2 1 https://github.com/atrodo/Net-Dropbear 1 https://github.com/mkj/dropbear 1 https://github.com/ytnobody/Otogiri 1 https://github.com/wrog/Net-OpenID-Consumer 1 https://github.com/garu/Dancer-Plugin-Auth-Google 1 https://github.com/robrwo/Text-Minify-XS 1 https://github.com/markstos/CGI.pm 1 https://github.com/scottchiefbaker/String-Util 1 https://github.com/rjbs/Email-Address 1 https://github.com/biafra/perl-Dancer2-Plugin-Auth-OAuth 1 https://github.com/jberger/Mojo-JWT 1 https://github.com/kraih/mojo 1 https://github.com/redhotpenguin/perl-Archive-Zip 1 https://github.com/faraco/App-Github-Email 1 https://github.com/moment/moment 1 https://github.com/moxiecode/plupload 1 https://github.com/creaktive/LWP-Protocol-Net-Curl 1 https://github.com/arodland/Crypt-PBKDF2 1 https://github.com/bestpractical/HTML-Gumbo 1 https://github.com/mojomojo/mojomojo 1 https://github.com/libwww-perl/WWW-Mechanize-Cached 1 https://github.com/perl-catalyst/FCGI 1