Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.4
CVE-2024-56406: Perl may crash or be exploited when processing certain characters
CVE-2024-56406 · published 1 year ago
Summary
All recent Perl releases (5.34 through 5.40 and development builds up to 5.41.10) can fail when they handle non‑ASCII bytes in a text‑replacement operation. This can cause the program to stop working and, on systems without strong protections, might allow an attacker to run code. Upgrade to the latest patched Perl version or apply the vendor’s security update.
What to do
- Update debian perl to version 5.36.0-7+deb12u2.
- Update debian perl to version 5.40.1-3.
- Update perl to version 5.36.2-r1.
- Update perl to version 5.38.3-r1.
- Update perl to version 5.40.1-r1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | perl | perl |
>= 5.33.1, < 5.38.4 >= 5.39.0, < 5.40.2 >= 5.41.0, <= 5.41.10 cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:* |
| Debian:12 | debian | perl |
< 5.36.0-7+deb12u2 Fix: upgrade to 5.36.0-7+deb12u2
|
| Debian:13 | debian | perl |
< 5.40.1-3 Fix: upgrade to 5.40.1-3
|
| Alpine:v3.18 | – | perl |
>= 5.33.1, < 5.36.2-r1 Fix: upgrade to 5.36.2-r1
|
| Alpine:v3.19 | – | perl |
>= 5.33.1, < 5.38.3-r1 Fix: upgrade to 5.38.3-r1
|
| Alpine:v3.21 | – | perl |
>= 5.33.1, < 5.40.1-r1 Fix: upgrade to 5.40.1-r1
|
Original advisory text
Perl is vulnerable to a heap buffer overflow when transliterating non-ASCII bytes
A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10. When there are non-ASCII bytes in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`. $ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;' Segmentation fault (core dumped) It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses.
References
- https://cpan.org/modules URL
- https://github.com/Perl/perl5/ URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56406... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-56406 Vendor Advisory
- https://security.alpinelinux.org/vuln/CVE-2024-56406 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2025/04/13/3 URL
- http://www.openwall.com/lists/oss-security/2025/04/13/4 URL
- http://www.openwall.com/lists/oss-security/2025/04/13/5 URL
- https://metacpan.org/release/SHAY/perl-5.38.4/changes Vendor Advisory
- https://metacpan.org/release/SHAY/perl-5.40.2/changes Vendor Advisory
- https://github.com/Perl/perl5/commit/87f42aa0e0096e9a346c9672aa3a0bd3bef8c1dd.pa... Patch
- https://security-tracker.debian.org/tracker/CVE-2024-56406 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-122Heap-based Buffer Overflow
CWE-787Out-of-bounds Write
Timeline
Published13 Apr 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-56406 · NVD
CVE-2024-56406 · OSV
DEBIAN-CVE-2024-56406 · OSV
ALPINE-CVE-2024-56406 · OSV
Track software like this
Free during beta