Perl Modules: Eight Vulnerabilities Disclosed, Affecting Core Components and Leading to DoS
Key findings • Eight Perl module vulnerabilities disclosed between Oct 19-23, 2026, impacting core components like DBI and HTTP::Headers::ActionPack. • Multiple Denial-of-Service vulnerabilit…
Key findings
- Eight Perl module vulnerabilities disclosed between Oct 19-23, 2026, impacting core components like DBI and HTTP::Headers::ActionPack.
- Multiple Denial-of-Service vulnerabilities found, including CPU and memory exhaustion in modules like Crypt::Age and Algorithm::UrataniTakeda.
- Information disclosure risks present, such as file inode numbers revealed by Plack::Middleware::ETag (CVE-2026-111946).
- DBI module affected by two critical issues: hangs due to lock mismanagement and crashes from type confusion.
- Patches are available for most vulnerabilities, with users urged to update affected modules like Rex, Robots::Validate, and Crypt::Age.
On October 23, 2026, a batch of eight vulnerabilities affecting various Perl modules was disclosed, spanning a disclosure window from October 19 to October 23. These vulnerabilities, identified by CVE IDs CVE-2026-113877, CVE-2026-94140, CVE-2026-112921, CVE-2026-113811, CVE-2026-85783, CVE-2026-111879, CVE-2026-108518, and CVE-2026-111946, highlight potential risks in widely used Perl components. The issues range from denial-of-service vulnerabilities due to CPU and memory exhaustion to information disclosure and potential crashes.
Several vulnerabilities focus on denial-of-service (DoS) conditions. CVE-2026-113877 in HTTP::Headers::ActionPack allows for CPU exhaustion by exploiting how Accept-Language ranges are interpolated into regular expressions. Similarly, CVE-2026-113811 in Algorithm::UrataniTakeda can lead to memory exhaustion through a failure shift cache that is never cleared. Crypt::Age is affected by CVE-2026-85783, which permits CPU exhaustion via an unbounded number of recipient stanzas, each requiring a costly X25519 scalar multiplication.
Other vulnerabilities impact the integrity and stability of Perl applications. CVE-2026-94140 in Rex, a remote execution tool, accepts unknown SSH host keys due to hardcoded StrictHostKeyChecking=no, potentially allowing man-in-the-middle attacks. Robots::Validate, addressed by CVE-2026-112921, may incorrectly flag clients as imposter robots due to state carrying over between requests.
The DBI module, a core component for database interaction in Perl, is implicated in two separate issues. CVE-2026-111879 describes a scenario where a failed open of a DBD::DBM table can lead to a hang because the table's lock is not released. Additionally, CVE-2026-108518 points to a crash in dbi_profile caused by type confusion when a database handle is destroyed while a Profile Path with an {attr} element is active.
Finally, CVE-2026-111946 in Plack::Middleware::ETag can disclose file inode numbers in the default ETag header, potentially revealing information about the server's file system structure.
The disclosed vulnerabilities affect specific versions of the affected modules, with patches available for most. For instance, DBI versions before 1.656 are impacted by CVE-2026-111879 and CVE-2026-108518, and users are advised to update to version 1.656 or later. HTTP::Headers::ActionPack versions prior to 0.10 are affected by CVE-2026-113877, with a fix in version 0.10. Rex versions through 1.16.1 are vulnerable to CVE-2026-94140. Robots::Validate versions from 0.4.3 before 0.4.10 are addressed by CVE-2026-112921, with a fix in 0.4.10. Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 are affected by CVE-2026-113811, patched in 0.1.7. Crypt::Age versions before 0.004 are vulnerable to CVE-2026-85783, with a fix in 0.004. Plack::Middleware::ETag versions from 0.04 before 0.06 are addressed by CVE-2026-111946, with a fix in 0.06. Users of these Perl modules are strongly encouraged to update to the patched versions to mitigate these security risks.
This batch of vulnerabilities underscores the importance of maintaining up-to-date Perl environments and regularly reviewing security advisories for critical modules. The diverse nature of these flaws, from DoS to information disclosure, emphasizes the need for a comprehensive security approach.