Perl Modules: Batch of Three Vulnerabilities in Punk, Tie::Hash::Regex, and Punk::OAuth2 Disclosed
Perl Foundation addresses three vulnerabilities in Punk, Tie::Hash::Regex, and Punk::OAuth2 modules, disclosed August 20-22, 2026.
Key findings
- Three Perl modules (Punk, Tie::Hash::Regex, Punk::OAuth2) affected by vulnerabilities disclosed between Aug 20-22, 2026.
- CVE-2026-75870 allows session cookie forgery in Punk < 0.18 due to missing HMAC secret.
- CVE-2026-77781 in Tie::Hash::Regex < 2.0.0 can throw exceptions on malformed lookup keys.
- CVE-2026-75628 in Punk::OAuth2 < 0.03 permits attacker-controlled off-site redirects.
- Patches are available for all disclosed vulnerabilities, requiring updates to specific module versions.
The Perl Foundation is addressing a batch of three vulnerabilities discovered in its ecosystem, with disclosures occurring between August 20 and August 22, 2026. These vulnerabilities affect different modules within Perl, including Punk, Tie::Hash::Regex, and Punk::OAuth2, and range in severity.
One of the key issues, CVE-2026-75870, impacts Punk versions prior to 0.18. This vulnerability allows for session cookie forgery due to an empty default HMAC key when a session is initialized without a secret. The session keyword in Punk freezes its options as provided, without enforcing the presence of a secret, and does not warn or refuse to start if one is missing. This can lead to security weaknesses in how session data is handled.
Another vulnerability, CVE-2026-77781, affects Tie::Hash::Regex versions before 2.0.0. This module will throw an exception when encountering unparseable lookup keys. Specifically, the FETCH, EXISTS, and DELETE methods raise an exception if they encounter malformed regular expressions. Each of these methods attempts a regex match when a key is not found in the hash, compiling the caller's key with a default regex.
The third vulnerability, CVE-2026-75628, found in Punk::OAuth2 versions before 0.03, permits an attacker-chosen off-site redirect after a user logs in. This is possible because the same_origin_path function incorrectly handles a backslash or tab character within the return parameter. The oauth2_login function reads the return parameter from the initiation request, processes it with same_origin_path, and stores the resulting value in the session flow, potentially redirecting users to malicious sites.
These vulnerabilities highlight the importance of keeping Perl modules updated to their latest versions. Users are advised to update Punk to version 0.18 or later, Tie::Hash::Regex to version 2.0.0 or later, and Punk::OAuth2 to version 0.03 or later to mitigate these security risks. The timely disclosure and patching of these issues by the Perl Foundation and its community are crucial for maintaining the security and integrity of applications built on the Perl platform.