Critical Perl Vulnerabilities Expose Ubuntu Systems to Remote Attacks

Ubuntu has issued urgent security updates addressing multiple vulnerabilities in the Perl programming language. These flaws span across various core modules and functionalities, including regular expression handling and memory management.

The identified issues pose significant risks to systems running vulnerable versions of Perl, potentially allowing attackers to access sensitive information, bypass security controls, or cause denial of service conditions. Some vulnerabilities may even enable arbitrary code execution under specific circumstances.

Memory Corruption Risks via Socket and Storable Modules

• Short source addresses in the Socket module can trigger out-of-bounds heap reads leading to information disclosure (CVE-2026-12087)
• Crafted data during deserialization with the Storable module causes integer overflows and application crashes (CVE-2026-57433)
• Large repeat counts in pack/unpack operations also result in out-of-bounds heap access patterns (CVE-2026-57432)

Regular Expression Processing Flaws

• Large fixed string alternatives in regex patterns can cause incorrect match results, enabling security restriction bypasses (CVE-2026-13221)
• Specific alternative matching branches in complex regex constructs similarly allow bypass of intended pattern matching behavior (CVE-2026-19487)
• Certain large input scenarios during regex evaluation may trigger heap memory corruption leading to crashes or code execution (CVE-2026-15534)

Sources

• USN-8675-2: Perl vulnerabilities
• USN-8736-1: Perl vulnerabilities