CVE-2026-8796 Sereal::Decoder versions before 5.005 for Perl allow heap out-of-bounds read via crafted input

[
  {
    "collectionURL": "https://cpan.org/modules",
    "defaultStatus": "unaffected",
    "packageName": "Sereal-Decoder",
    "product": "Sereal::Decoder",
    "programFiles": [
      "Perl/Decoder/srl_decoder.c"
    ],
    "programRoutines": [
      {
        "name": "srl_read_object()"
      },
      {
        "name": "srl_read_hash()"
      }
    ],
    "repo": "https://github.com/Sereal/Sereal",
    "vendor": "YVES",
    "versions": [
      {
        "lessThan": "5.005",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]