Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-13221: Perl packages could allow attacker code execution
CVE-2026-13221 · published today
Summary
The Perl software offered by Canonical, Debian, and Alpine may let a malicious user run their own code on your system. This could compromise data or disrupt services if left unpatched. Install the latest updated Perl packages as soon as possible to protect your environment.
What to do
- Update canonical perl to version 5.18.2-2ubuntu1.7+esm8.
- Update canonical perl to version 5.22.1-9ubuntu0.9+esm3.
- Update canonical perl to version 5.26.1-6ubuntu0.7+esm3.
- Update canonical perl to version 5.30.0-9ubuntu0.5+esm3.
- Update canonical perl to version 5.34.0-3ubuntu1.8.
- Update canonical perl to version 5.38.2-3.2ubuntu0.4.
- Update debian rootio-perl to version 5.36.0-7+deb12u3.root.io.11.
- Update debian rootio-perl to version 5.40.1-6.root.io.5.
- Update debian rootio-perl to version 5.36.0-7+deb12u3.root.io.12.
- Update debian perl to version 5.32.1-4+deb11u5.root.io.5.
- Update debian perl to version 5.40.1-6.root.io.5.
- Update debian perl to version 5.42.3-1.
- Update alpine perl to version 5.42.2-r00071.
- Update alpine perl to version 5.40.4-r00071.
- Update alpine rootio-perl to version 5.40.4-r00071.
- Update alpine rootio-perl to version 5.42.2-r00071.
- Update debian rootio-perl to version 5.32.1-4+deb11u5.root.io.5.
- Update debian perl to version 5.36.0-7+deb12u3.root.io.12.
- Update debian perl to version 5.40.1-6.aikido.10.
- Update debian rootio-perl to version 5.40.1-6.aikido.10.
- Update canonical perl to version 5.40.1-7ubuntu0.3.
- Update perl to version 5.40.4-r00072.
- Update rootio-perl to version 5.40.4-r00072.
- Update debian perl to version 5.40.1-6+deb13u1.
- Update perl to version 5.42.2-r00072.
- Update rootio-perl to version 5.42.2-r00072.
- Update perl to version 5.40.1-6.aikido.10.
- Update rootio-perl to version 5.40.1-6.aikido.10.
- Update perl to version 5.42.2-r1.
- Update perl to version 5.36.0-7+deb12u3.aikido.19.
- Update rootio-perl to version 5.36.0-7+deb12u3.aikido.19.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:22.04:LTS | canonical | perl |
< 5.34.0-3ubuntu1.8 Fix: upgrade to 5.34.0-3ubuntu1.8
|
| Ubuntu:24.04:LTS | canonical | perl |
< 5.38.2-3.2ubuntu0.4 Fix: upgrade to 5.38.2-3.2ubuntu0.4
|
| Ubuntu:26.04:LTS | canonical | perl |
< 5.40.1-7ubuntu0.3 Fix: upgrade to 5.40.1-7ubuntu0.3
|
| Debian:11 | debian | perl | All versions |
| Debian:12 | debian | perl | All versions |
| Debian:13 | debian | perl |
< 5.40.1-6+deb13u1 Fix: upgrade to 5.40.1-6+deb13u1
|
| Debian:14 | debian | perl |
< 5.42.3-1 Fix: upgrade to 5.42.3-1
|
| Ubuntu:Pro:14.04:LTS | canonical | perl |
< 5.18.2-2ubuntu1.7+esm8 Fix: upgrade to 5.18.2-2ubuntu1.7+esm8
|
| Ubuntu:Pro:16.04:LTS | canonical | perl |
< 5.22.1-9ubuntu0.9+esm3 Fix: upgrade to 5.22.1-9ubuntu0.9+esm3
|
| Ubuntu:Pro:18.04:LTS | canonical | perl |
< 5.26.1-6ubuntu0.7+esm3 Fix: upgrade to 5.26.1-6ubuntu0.7+esm3
|
| Ubuntu:Pro:20.04:LTS | canonical | perl |
< 5.30.0-9ubuntu0.5+esm3 Fix: upgrade to 5.30.0-9ubuntu0.5+esm3
|
| – | perl | perl |
<= 5.43.9 cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:* |
| Root:Debian:12 | debian | rootio-perl |
< 5.36.0-7+deb12u3.root.io.11 < 5.36.0-7+deb12u3.root.io.12 Fix: upgrade to 5.36.0-7+deb12u3.root.io.11
|
| Root:Debian:13 | debian | rootio-perl |
< 5.40.1-6.root.io.5 < 5.40.1-6.aikido.10 Fix: upgrade to 5.40.1-6.root.io.5
|
| Root:Debian:11 | debian | perl |
< 5.32.1-4+deb11u5.root.io.5 Fix: upgrade to 5.32.1-4+deb11u5.root.io.5
|
| Root:Debian:13 | debian | perl |
< 5.40.1-6.root.io.5 < 5.40.1-6.aikido.10 Fix: upgrade to 5.40.1-6.root.io.5
|
| Root:Alpine:3.23 | alpine | perl |
< 5.42.2-r00071 Fix: upgrade to 5.42.2-r00071
|
| Root:Alpine:3.22 | alpine | perl |
< 5.40.4-r00071 Fix: upgrade to 5.40.4-r00071
|
| Root:Alpine:3.22 | alpine | rootio-perl |
< 5.40.4-r00071 Fix: upgrade to 5.40.4-r00071
|
| Root:Alpine:3.23 | alpine | rootio-perl |
< 5.42.2-r00071 Fix: upgrade to 5.42.2-r00071
|
| Root:Debian:11 | debian | rootio-perl |
< 5.32.1-4+deb11u5.root.io.5 Fix: upgrade to 5.32.1-4+deb11u5.root.io.5
|
| Root:Debian:12 | debian | perl |
< 5.36.0-7+deb12u3.root.io.12 Fix: upgrade to 5.36.0-7+deb12u3.root.io.12
|
| Root:Alpine:3.22 | – | perl |
< 5.40.4-r00072 Fix: upgrade to 5.40.4-r00072
|
| Root:Alpine:3.22 | – | rootio-perl |
< 5.40.4-r00072 Fix: upgrade to 5.40.4-r00072
|
| Root:Alpine:3.23 | – | perl |
< 5.42.2-r00072 Fix: upgrade to 5.42.2-r00072
|
| Root:Alpine:3.23 | – | rootio-perl |
< 5.42.2-r00072 Fix: upgrade to 5.42.2-r00072
|
| Root:Debian:13 | – | perl |
< 5.40.1-6.aikido.10 Fix: upgrade to 5.40.1-6.aikido.10
|
| Root:Debian:13 | – | rootio-perl |
< 5.40.1-6.aikido.10 Fix: upgrade to 5.40.1-6.aikido.10
|
| Alpine:v3.24 | – | perl |
< 5.42.2-r1 Fix: upgrade to 5.42.2-r1
|
| Root:Debian:12 | – | perl |
< 5.36.0-7+deb12u3.aikido.19 Fix: upgrade to 5.36.0-7+deb12u3.aikido.19
|
| Root:Debian:12 | – | rootio-perl |
< 5.36.0-7+deb12u3.aikido.19 Fix: upgrade to 5.36.0-7+deb12u3.aikido.19
|
Original advisory text
CVE-2026-13221 in perl - Patched by Root
Root has patched CVE-2026-13221 in the perl package for Root:Debian:12. Multiple fixed versions available.
References
- https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.pa... Patch
- https://security-tracker.debian.org/tracker/CVE-2026-13221 Vendor Advisory
- https://cpan.org/modules URL
- http://www.openwall.com/lists/oss-security/2026/07/13/5 Mailing List Patch Third Party Advisory
- https://ubuntu.com/security/CVE-2026-13221 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13221... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-13221 Vendor Advisory
- https://github.com/Perl/perl5 Product
- https://github.com/Perl/perl5/issues/23388 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-13221 Third Party Advisory
- https://lists.security.metacpan.org/cve-announce/msg/41780104/ Third Party Advisory
- https://ubuntu.com/security/notices/USN-8675-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8684-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8675-2 Vendor Advisory
- https://security.alpinelinux.org/vuln/CVE-2026-13221 Vendor Advisory
Severity
9.1
Critical
CVSS 3.1: 9.1 (OSV)
Exploitation
EPSS <1%
Type
CWE-190Integer Overflow
Timeline
Published28 Sep 2026
Updated28 Sep 2026
First seen13 Jul 2026
Sources
CVE-2026-13221 · OSV
CVE-2026-13221 · NVD
DEBIAN-CVE-2026-13221 · OSV
UBUNTU-CVE-2026-13221 · OSV
ALPINE-CVE-2026-13221 · OSV
Track software like this
Free during beta