Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
Perl Socket: Out-of-bounds heap read vulnerability
published 4 months ago
Summary
A security update is available for Perl Socket versions before 2.041, which could allow an attacker to access sensitive information. This issue affects systems using Perl Socket for network operations. To stay secure, ensure you have the latest version of Perl Socket installed.
What to do
- Update openeuler perl to version 5.38.0-13.oe2403sp1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| openEuler:24.03-LTS-SP1 | openeuler | perl |
< 5.38.0-13.oe2403sp1 Fix: upgrade to 5.38.0-13.oe2403sp1
|
Original advisory text
perl security update
Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects.
Security Fix(es):
Socket versions before 2.041 for Perl have an out-of-bounds heap read.
In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.
Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.(CVE-2026-12087)
Security Fix(es):
Socket versions before 2.041 for Perl have an out-of-bounds heap read.
In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.
Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.(CVE-2026-12087)
References
- https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-12087 Vendor Advisory
Severity
9.1
Critical
Timeline
Published6 Jul 2026
Updated18 Aug 2026
First seen6 Jul 2026
Sources
OESA-2026-2844 · OSV
Track software like this
Free during beta