CVE-2026-57432 Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack

[
  {
    "collectionURL": "https://cpan.org/modules",
    "defaultStatus": "unaffected",
    "modules": [
      "perl"
    ],
    "packageName": "perl",
    "packageURL": "pkg:cpan/perl",
    "programFiles": [
      "pp_pack.c"
    ],
    "programRoutines": [
      {
        "name": "S_measure_struct"
      }
    ],
    "repo": "https://github.com/Perl/perl5",
    "versions": [
      {
        "lessThan": "5.40.5-RC1",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      },
      {
        "lessThan": "5.42.3-RC1",
        "status": "affected",
        "version": "5.41.0",
        "versionType": "custom"
      },
      {
        "lessThan": "5.43.11",
        "status": "affected",
        "version": "5.43.0",
        "versionType": "custom"
      }
    ]
  }
]