Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Perl on Debian can overflow memory and crash
published 5 months ago
Summary
The Perl interpreter and its development libraries for Debian 32-bit systems can write beyond the intended memory area when processing certain regular‑expression patterns. This could cause the program to stop working or allow an attacker to take control. Apply the latest Debian security update for the perl packages to fix the issue.
What to do
- Update debian libperl-dev to version 5.28.1-6+deb10u1+tuxcare.els2.
- Update debian libperl5.28 to version 5.28.1-6+deb10u1+tuxcare.els2.
- Update debian perl to version 5.28.1-6+deb10u1+tuxcare.els2.
- Update debian perl-base to version 5.28.1-6+deb10u1+tuxcare.els2.
- Update debian perl-debug to version 5.28.1-6+deb10u1+tuxcare.els2.
- Update debian perl-doc to version 5.28.1-6+deb10u1+tuxcare.els2.
- Update debian perl-modules-5.28 to version 5.28.1-6+deb10u1+tuxcare.els2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:Debian:10 | debian | libperl-dev |
< 5.28.1-6+deb10u1+tuxcare.els2 Fix: upgrade to 5.28.1-6+deb10u1+tuxcare.els2
|
| TuxCare:Debian:10 | debian | libperl5.28 |
< 5.28.1-6+deb10u1+tuxcare.els2 Fix: upgrade to 5.28.1-6+deb10u1+tuxcare.els2
|
| TuxCare:Debian:10 | debian | perl |
< 5.28.1-6+deb10u1+tuxcare.els2 Fix: upgrade to 5.28.1-6+deb10u1+tuxcare.els2
|
| TuxCare:Debian:10 | debian | perl-base |
< 5.28.1-6+deb10u1+tuxcare.els2 Fix: upgrade to 5.28.1-6+deb10u1+tuxcare.els2
|
| TuxCare:Debian:10 | debian | perl-debug |
< 5.28.1-6+deb10u1+tuxcare.els2 Fix: upgrade to 5.28.1-6+deb10u1+tuxcare.els2
|
| TuxCare:Debian:10 | debian | perl-doc |
< 5.28.1-6+deb10u1+tuxcare.els2 Fix: upgrade to 5.28.1-6+deb10u1+tuxcare.els2
|
| TuxCare:Debian:10 | debian | perl-modules-5.28 |
< 5.28.1-6+deb10u1+tuxcare.els2 Fix: upgrade to 5.28.1-6+deb10u1+tuxcare.els2
|
Original advisory text
Fix CVE(s): CVE-2026-8376
* SECURITY UPDATE: heap buffer overflow in regex compilation with repeated fixed string on 32-bit builds
- debian/patches/fixes/CVE-2026-8376.patch: add SSize_t overflow check
before SvGROW in Perl_study_chunk()
- CVE-2026-8376
- debian/patches/fixes/CVE-2026-8376.patch: add SSize_t overflow check
before SvGROW in Perl_study_chunk()
- CVE-2026-8376
References
- https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1780477837.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-8376 Vendor Advisory
Timeline
Published3 Jun 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1780477837 · OSV
Track software like this
Free during beta