CVE-2026-14895 String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-14895?
CVE-2026-14895 is a high-severity vulnerability in BAKERSCOT String::Util, published on 7 Jul 2026.
Official description
String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service.
The trim and rtrim functions stripped trailing whitespace with s/\s*$//u. Because \s* matches greedily and the $ anchor fails whenever a non-whitespace character follows the whitespace, the regex engine retries the match at each offset of a long whitespace run, producing quadratic backtracking. The fix replaces \s*$ with \s+$.
Any caller that passes untrusted input to trim or rtrim can trigger CPU exhaustion with a string containing a long run of whitespace.
Weakness: CWE-1333
Which versions are affected by CVE-2026-14895?
How do I fix CVE-2026-14895?
Upgrade to a fixed version.
Is CVE-2026-14895 being exploited?
There is no known exploitation of CVE-2026-14895 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-14895, GHSA-vm32-9cff-wgh2, MGASA-2026-0272, UBUNTU-CVE-2026-14895.