CVE-2026-57433 Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record
A signed integer overflow in Perl's Storable library allows attackers to cause a denial of service via crafted serialized data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-57433?
CVE-2026-57433 is a critical vulnerability in HAARG Storable, published on 13 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.
retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.
A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.
Weakness: CWE-190
Which versions are affected by CVE-2026-57433?
It affects 1 product.
Products include Nwclark Storable.
How do I fix CVE-2026-57433?
Upgrade to a fixed version.
Is CVE-2026-57433 being exploited?
There is no known exploitation of CVE-2026-57433 in the wild and no public exploit code.
Other vulnerabilities in HAARG Storable
Sources
Also known as AZL-92415, CLSA-2026-1788175535, CLSA-2026-1788175793, CLSA-2026-1788194548, DEBIAN-CVE-2026-57433, ECHO-d227-33d7-30bd and 3 more.