Perl Modules: Ten Vulnerabilities Disclosed, Including Critical Code Execution and Heap Write Flaws
Key findings • Ten vulnerabilities across various Perl modules disclosed between August 12-15, 2026. • Critical flaws include code execution in PDF::WebKit (CVE-2026-16770) and resource exhau…
Key findings
- Ten vulnerabilities across various Perl modules disclosed between August 12-15, 2026.
- Critical flaws include code execution in PDF::WebKit (CVE-2026-16770) and resource exhaustion in Form::Processor::Field::HtmlArea (CVE-2026-13051).
- DBI versions before 1.652 are vulnerable to heap out-of-bounds writes (CVE-2026-73194, CVE-2026-73193).
- Patches are available for most affected modules, including DBI, PDF::WebKit, and Net::CIDR::Set.
- Vulnerabilities impact core Perl, DBI, PDF::WebKit, and several other widely used modules.
On August 13, 2026, a batch of ten vulnerabilities affecting various Perl modules was disclosed, spanning a three-day window from August 12th to August 15th. These vulnerabilities range in severity from medium to critical, with several allowing for critical impacts such as arbitrary code execution, resource exhaustion, and critical security bypasses. The disclosures highlight potential risks for applications relying on these widely used Perl components.
Several critical vulnerabilities were disclosed, including CVE-2026-16770, a critical (CVSSv3 9.8) flaw in PDF::WebKit affecting versions through 1.2. This vulnerability allows for argument injection into the wkhtmltopdf utility via meta tags in the source document, potentially leading to command execution. Another critical vulnerability, CVE-2026-13051 (CVSSv3 9.1), affects Form::Processor::Field::HtmlArea versions 0.06 through 1.162360. It permits attacker-selected method dispatch and resource exhaustion through an HTML::Tidy diagnostic that validates passes to add_error as a Locale::Maketext template. Additionally, CVE-2022-4993, a critical (CVSSv3 9.1) vulnerability in HTML::FormHandler versions through 0.40068, allows for attacker-selected method dispatch and resource exhaustion due to the use of error message text from request data as a Locale::Maketext bracket notation template.
High severity vulnerabilities were also part of this disclosure batch. CVE-2026-19566, a high (CVSSv3 7.5) flaw in Net::CIDR::Set versions before 0.23, can lead to memory exhaustion and malformed set ranges through unbounded IPv6 prefix lengths. Another high severity issue, CVE-2026-13048 (CVSSv3 8.2), affects Data::MuForm::Localizer versions through 0.05, enabling Perl code execution from a message catalog header due to an unvalidated language attribute that interpolates into the catalog filename.
Further vulnerabilities include medium-severity issues such as CVE-2026-19487 (CVSSv3 5.3) in Perl versions from 5.9.4 before 5.41.9, which can produce incorrect regular expression match results due to a stale failure flag. CVE-2026-17431 (CVSSv3 6.1), a medium severity flaw in PDF::WebKit versions through 1.2, allows OS command injection via a 2-argument open() of the output path. Two other vulnerabilities, CVE-2026-73194 and CVE-2026-73193, both affecting DBI versions before 1.652, allow for heap out-of-bounds writes due to unvalidated numeric placeholders or integer wraparound in the output buffer size computation, respectively. Lastly, CVE-2026-15689, a vulnerability in Dancer2::Plugin::Auth::Extensible versions through 0.713, permits password reset link poisoning via the request Host header.
The disclosed vulnerabilities impact a range of Perl modules, including core Perl itself, DBI, PDF::WebKit, Form::Processor::Field::HtmlArea, Data::MuForm::Localizer, Net::CIDR::Set, and Dancer2::Plugin::Auth::Extensible. Users of these modules are advised to update to the patched versions as soon as possible. For DBI, versions 1.652 and later are recommended. For PDF::WebKit, users should update to versions later than 1.2. Form::Processor::Field::HtmlArea and Data::MuForm::Localizer should be updated to versions beyond 1.162360 and 0.05, respectively. Net::CIDR::Set should be updated to 0.23 or later, and Dancer2::Plugin::Auth::Extensible to versions beyond 0.713. Perl versions 5.41.9 and later address the regular expression issue.
This batch of vulnerabilities underscores the importance of maintaining up-to-date installations of Perl and its associated modules. The critical nature of several flaws, particularly those allowing code execution and bypasses, necessitates prompt attention from developers and system administrators to mitigate potential security risks. Regular auditing of dependencies and timely application of security patches are crucial for safeguarding applications built on the Perl ecosystem.