synced 11 MIN AGO
01 Record

CVE-2024-56406

Perl is vulnerable to a heap buffer overflow when transliterating non-ASCII bytes

HighPUBLISHEDCNA: CPANSec
CNA base score8.4 CVSS v3.xCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
View raw JSON

02 Description

Perl is vulnerable to a heap buffer overflow when transliterating non-ASCII bytes

03 Exploitation and scoring

Exploitation
Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.
SSVC decision
  • ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
  • AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
  • Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.
CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.
EPSS probability
0.53% probability of exploitation activity in the next 30 days.
EPSS percentile
Equal to or higher than the score of 44.8% of scored records. A rank, not a probability.
NVD base score
8.4 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD analysis status
Modified. NVD last modified this record on 2026-06-17.
Red Hat severity
Important. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published
2025-04-13 13:16Z1 YR AGO
Last updated
2025-10-16 14:04Z1 YR AGO
Reserved
2024-12-23
Assigning CNA
CPANSec
Record state
PUBLISHED
Severity
High (CVSS 8.4)
CNA CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
  • CWE-122Heap-based Buffer OverflowVariant
  • CWE-787Out-of-bounds WriteBase
Data version
5.1
Document digest
e87bb745f0bee71f2cc0bebc3fe41c8ef1e517b6b43fcb6c0db919d2e0969ba6

05 Affected products

VendorProductVersionsPlatforms
perlperl5.41.0 to 5.41.10, 5.39.0 to < 5.40.2-RC1, 5.33.1 to < 5.38.4-RC1—

06 References

07 Remediation

Users should update perl to 5.40.2 or 5.38.4, or apply the upstream patch provided in the References section.

08 Fixed in

AlmaLinux 10

  • perl
    Fixed in 4:5.40.2-512.1.el10_0
  • perl-Attribute-Handlers
    Fixed in 1.03-512.1.el10_0
  • perl-AutoLoader
    Fixed in 5.74-512.1.el10_0
  • perl-AutoSplit
    Fixed in 5.74-512.1.el10_0
  • perl-B
    Fixed in 1.89-512.1.el10_0
  • perl-Benchmark
    Fixed in 1.25-512.1.el10_0
  • perl-Class-Struct
    Fixed in 0.68-512.1.el10_0
  • perl-Config-Extensions
    Fixed in 0.03-512.1.el10_0
  • perl-DBM_Filter
    Fixed in 0.06-512.1.el10_0
  • perl-Devel-Peek
    Fixed in 1.34-512.1.el10_0
  • perl-Devel-SelfStubber
    Fixed in 1.06-512.1.el10_0
  • perl-DirHandle
    Fixed in 1.05-512.1.el10_0
  • perl-Dumpvalue
    Fixed in 2.27-512.1.el10_0
  • perl-DynaLoader
    Fixed in 1.56-512.1.el10_0
  • perl-English
    Fixed in 1.11-512.1.el10_0
  • perl-Errno
    Fixed in 1.38-512.1.el10_0
  • perl-ExtUtils-Constant
    Fixed in 0.25-512.1.el10_0
  • perl-ExtUtils-Embed
    Fixed in 1.35-512.1.el10_0
  • perl-ExtUtils-Miniperl
    Fixed in 1.14-512.1.el10_0
  • perl-Fcntl
    Fixed in 1.18-512.1.el10_0
  • perl-File-Basename
    Fixed in 2.86-512.1.el10_0
  • perl-File-Compare
    Fixed in 1.100.800-512.1.el10_0
  • perl-File-Copy
    Fixed in 2.41-512.1.el10_0
  • perl-File-DosGlob
    Fixed in 1.12-512.1.el10_0
  • perl-File-Find
    Fixed in 1.44-512.1.el10_0
  • perl-File-stat
    Fixed in 1.14-512.1.el10_0
  • perl-FileCache
    Fixed in 1.10-512.1.el10_0
  • perl-FileHandle
    Fixed in 2.05-512.1.el10_0
  • perl-FindBin
    Fixed in 1.54-512.1.el10_0
  • perl-GDBM_File
    Fixed in 1:1.24-512.1.el10_0
  • perl-Getopt-Std
    Fixed in 1.14-512.1.el10_0
  • perl-Hash-Util
    Fixed in 0.32-512.1.el10_0
  • perl-Hash-Util-FieldHash
    Fixed in 1.27-512.1.el10_0
  • perl-I18N-Collate
    Fixed in 1.02-512.1.el10_0
  • perl-I18N-LangTags
    Fixed in 0.45-512.1.el10_0
  • perl-I18N-Langinfo
    Fixed in 0.24-512.1.el10_0
  • perl-IO
    Fixed in 1.55-512.1.el10_0
  • perl-IPC-Open3
    Fixed in 1.22-512.1.el10_0
  • perl-Locale-Maketext-Simple
    Fixed in 1:0.21-512.1.el10_0
  • perl-Math-Complex
    Fixed in 1.62-512.1.el10_0

60 further packages in AlmaLinux 10 not shown (first 40 listed).

Source: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.

CloudLinux 10

  • perl
    Fixed in 4:5.40.2-512.1.el10_0
  • perl-Attribute-Handlers
    Fixed in 1.03-512.1.el10_0
  • perl-AutoLoader
    Fixed in 5.74-512.1.el10_0
  • perl-AutoSplit
    Fixed in 5.74-512.1.el10_0
  • perl-B
    Fixed in 1.89-512.1.el10_0
  • perl-Benchmark
    Fixed in 1.25-512.1.el10_0
  • perl-Class-Struct
    Fixed in 0.68-512.1.el10_0
  • perl-Config-Extensions
    Fixed in 0.03-512.1.el10_0
  • perl-DBM_Filter
    Fixed in 0.06-512.1.el10_0
  • perl-Devel-Peek
    Fixed in 1.34-512.1.el10_0
  • perl-Devel-SelfStubber
    Fixed in 1.06-512.1.el10_0
  • perl-DirHandle
    Fixed in 1.05-512.1.el10_0
  • perl-Dumpvalue
    Fixed in 2.27-512.1.el10_0
  • perl-DynaLoader
    Fixed in 1.56-512.1.el10_0
  • perl-English
    Fixed in 1.11-512.1.el10_0
  • perl-Errno
    Fixed in 1.38-512.1.el10_0
  • perl-ExtUtils-Constant
    Fixed in 0.25-512.1.el10_0
  • perl-ExtUtils-Embed
    Fixed in 1.35-512.1.el10_0
  • perl-ExtUtils-Miniperl
    Fixed in 1.14-512.1.el10_0
  • perl-Fcntl
    Fixed in 1.18-512.1.el10_0
  • perl-File-Basename
    Fixed in 2.86-512.1.el10_0
  • perl-File-Compare
    Fixed in 1.100.800-512.1.el10_0
  • perl-File-Copy
    Fixed in 2.41-512.1.el10_0
  • perl-File-DosGlob
    Fixed in 1.12-512.1.el10_0
  • perl-File-Find
    Fixed in 1.44-512.1.el10_0
  • perl-File-stat
    Fixed in 1.14-512.1.el10_0
  • perl-FileCache
    Fixed in 1.10-512.1.el10_0
  • perl-FileHandle
    Fixed in 2.05-512.1.el10_0
  • perl-FindBin
    Fixed in 1.54-512.1.el10_0
  • perl-GDBM_File
    Fixed in 1:1.24-512.1.el10_0
  • perl-Getopt-Std
    Fixed in 1.14-512.1.el10_0
  • perl-Hash-Util
    Fixed in 0.32-512.1.el10_0
  • perl-Hash-Util-FieldHash
    Fixed in 1.27-512.1.el10_0
  • perl-I18N-Collate
    Fixed in 1.02-512.1.el10_0
  • perl-I18N-LangTags
    Fixed in 0.45-512.1.el10_0
  • perl-I18N-Langinfo
    Fixed in 0.24-512.1.el10_0
  • perl-IO
    Fixed in 1.55-512.1.el10_0
  • perl-IPC-Open3
    Fixed in 1.22-512.1.el10_0
  • perl-Locale-Maketext-Simple
    Fixed in 1:0.21-512.1.el10_0
  • perl-Math-Complex
    Fixed in 1.62-512.1.el10_0

60 further packages in CloudLinux 10 not shown (first 40 listed).

Derived from AlmaLinux 10. Partial coverage: only packages taken from AlmaLinux 10 are listed.

Source: CloudLinux errata, CloudLinux Inc. Derived from: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.

Debian 12

  • perl
    Fixed in 5.36.0-7+deb12u2

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

  • perl
    Fixed in 5.40.1-3

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

  • perl
    Fixed in 5.40.1-3

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 22.04 LTS

  • perl
    Fixed in 5.34.0-3ubuntu1.4

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 24.04 LTS

  • perl
    Fixed in 5.38.2-3.2ubuntu0.1

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.