19071 matches found
Astra Linux – Vulnerability in libhttp-daemon-perl
HTTP::Daemon is a simple HTTP server class written in Perl. Versions prior to 6.15 are vulnerable to a vulnerability that could potentially be exploited to gain privileged access to APIs or corrupt intermediate caches. It’s unclear how severe the risks are; most Perl-based applications are served...
Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass
...
CVE-2026-78183
DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quotefloat. quotefloat allocates the length of the string + 1, which is the size of the bare numeric symbol plus NULL. But for special literals NaN, Inf, +Inf, -Inf, Infinity, +Infinity, -Infinity it emits the literal surrounded by...
UBUNTU-CVE-2026-78183
DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quotefloat. quotefloat allocates the length of the string + 1, which is the size of the bare numeric symbol plus NULL. But for special literals NaN, Inf, +Inf, -Inf, Infinity, +Infinity, -Infinity it emits the literal surrounded by...
CVE-2026-78183
DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quotefloat. quotefloat allocates the length of the string + 1, which is the size of the bare numeric symbol plus NULL. But for special literals NaN, Inf, +Inf, -Inf, Infinity, +Infinity, -Infinity it emits the literal surrounded by...
CVE-2026-78183 DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quote_float
DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quotefloat. quotefloat allocates the length of the string + 1, which is the size of the bare numeric symbol plus NULL. But for special literals NaN, Inf, +Inf, -Inf, Infinity, +Infinity, -Infinity it emits the literal surrounded by...
CVE-2026-78183 DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quote_float
DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quotefloat. quotefloat allocates the length of the string + 1, which is the size of the bare numeric symbol plus NULL. But for special literals NaN, Inf, +Inf, -Inf, Infinity, +Infinity, -Infinity it emits the literal surrounded by...
CVE-2026-78183
DBD::Pg version 3.21.0 for Perl contains a heap out-of-bounds write in the quote_float function (in quote.c). The function allocates a buffer of length + 1 bytes for numeric strings, but when emitting special float literals (NaN, Inf, +Inf, -Inf, Infinity, +Infinity, -Infinity), it writes the lit...
CVE-2026-78183
DBD::Pg version 3.21.0 for Perl has a heap out-of-bounds write in quotefloat. quotefloat allocates the length of the string + 1, which is the size of the bare numeric symbol plus NULL. But for special literals NaN, Inf, +Inf, -Inf, Infinity, +Infinity, -Infinity it emits the literal surrounded by...
CVE-2026-19565 Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey
Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey. CreateSessionAuthKey runs five rounds of SHA-256, each over a fresh Time::HiRes reading formatted to six decimal places, the running...
EUVD-2026-64663
Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey. CreateSessionAuthKey runs five rounds of SHA-256, each over a fresh Time::HiRes reading formatted to six decimal places, the running...
CVE-2026-75922
Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATHINFO written unencoded to the upstream request line. PSGI hands PATHINFO to an application percent-decoded, so a %XX sequence in the client URL has become a raw byte by the time the proxy sees it...
CVE-2026-75922
Reverse::Proxy (CPAN module by LNATION) versions before 0.04 for Perl are vulnerable to HTTP request smuggling via a percent-decoded PATH_INFO written unencoded into the upstream request line. Because PSGI delivers PATH_INFO already decoded, a client-controlled %0d%0a in the URL becomes a raw CRL...
CVE-2026-75922 Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request line
Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATHINFO written unencoded to the upstream request line. PSGI hands PATHINFO to an application percent-decoded, so a %XX sequence in the client URL has become a raw byte by the time the proxy sees it...
EUVD-2026-64662
Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATHINFO written unencoded to the upstream request line. PSGI hands PATHINFO to an application percent-decoded, so a %XX sequence in the client URL has become a raw byte by the time the proxy sees it...
ROOT-OS-DEBIAN-11-CVE-2026-42497 CVE-2026-42497 in perl - Patched by Root
Root has patched CVE-2026-42497 in the perl package for Root:Debian:11. Multiple fixed versions available...
ROOT-OS-DEBIAN-11-CVE-2026-9538 CVE-2026-9538 in perl - Patched by Root
Root has patched CVE-2026-9538 in the perl package for Root:Debian:11. Multiple fixed versions available...
ROOT-OS-DEBIAN-11-CVE-2026-7010 CVE-2026-7010 in perl - Patched by Root
Root has patched CVE-2026-7010 in the perl package for Root:Debian:11. Multiple fixed versions available...