CVE-2026-13221 Integer overflow in perl:perl

What is CVE-2026-13221?

CVE-2026-13221 is a critical vulnerability in perl:perl, published on 13 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.

When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.

A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.

Weakness: CWE-190

Which versions are affected by CVE-2026-13221?

It affects 1 product.

Products include Perl Perl.

How do I fix CVE-2026-13221?

Upgrade to a fixed version.

Is CVE-2026-13221 being exploited?

There is no known exploitation of CVE-2026-13221 in the wild and no public exploit code.

Other vulnerabilities in perl:perl

• CVE-2026-4176 Supply chain in perl Critical 9.8
• CVE-2022-48522 Memory corruption in n/a Critical 9.8
• CVE-2017-12814 Memory corruption in n/a Critical 9.8
• CVE-2015-8608 Memory corruption in n/a Critical 9.8
• CVE-2017-12883 Memory corruption in n/a Critical 9.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2026-13221, ALSA-2026:67155, ALSA-2026:67156, ALSA-2026:67162, ALSA-2026:67278, AZL-92300 and 22 more.