CVE-2026-65064

Data::HashMap::Shared before 0.14 for Perl creates a world-readable mmap backing file and opens it with 0666 permissions, without O_EXCL or O_NOFOLLOW. The file is opened with open(path, O_RDWR|O_CREAT|O_CLOEXEC, 0666) in shm_generic.h, yielding a world-readable 0644 file (umask 022). A pre-creat...

CVE-2026-65061

Data::ReqRep::Shared for Perl is affected in versions before 0.05. The issue arises because the code creates a world-readable mmap backing file by opening path with O_RDWR | O_CREAT and mode 0666 (leading to 0644 under umask) and does not use O_EXCL or O_NOFOLLOW, allowing a local user to read IP...

CVE-2026-64616 Data::NDArray::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW

Data::NDArray::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in ndarray.h with openpath, ORDWR|OCREAT, 0666. The mode is 0666, so under the default umask 022 the file is created mode 0644 world-readabl...

CVE-2026-64616

CVE-2026-64616 affects Data::NDArray::Shared prior to version 0.02 for Perl. The code creates a mmap-backed segment by opening a path with open(path, O_RDWR|O_CREAT, 0666) and mode 0666, leading to a world-readable file (0644 after umask). With O_NOFOLLOW absent and O_EXCL absent, a symlink or pr...

CVE-2026-64615 Data::Graph::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW

Data::Graph::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in graph.h with openpath, ORDWR|OCREAT, 0666. The mode is 0666, so under the default umask 022 the file is created mode 0644 world-readable...

CVE-2026-64613 Data::Buffer::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without O_NOFOLLOW

Data::Buffer::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without ONOFOLLOW. The segment is created in bufgeneric.h with openpath, ORDWR|OCREAT|OEXCL, 0666. OEXCL blocks a pre-seeded file on create, but the mode is 0666, so under the default umask 02...

CVE-2026-59145

Data::Intern::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated slot, reverse and arena indices in siidxfind. The attach-time validator sivalidateheader is thorough about the header and layout magic, version, section offsets, totalsize, count and arenaused but does...

CVE-2026-59145 Data::Intern::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated slot, reverse and arena indices in si_idx_find

Data::Intern::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated slot, reverse and arena indices in siidxfind. The attach-time validator sivalidateheader is thorough about the header and layout magic, version, section offsets, totalsize, count and arenaused but does...

CVE-2026-59143

CVE-2026-59143 affects Data::RoaringBitmap::Shared before 0.02 for Perl. An out-of-bounds read arises in rb_contains_locked due to an unvalidated container offset and cardinality: the attach-time validator checks header and region layout against file size but does not validate bucket contents, an...

CVE-2026-59142

Data::HashMap::Shared versions before 0.14 for Perl allow an out-of-bounds read via an unvalidated arena offset and length in shmstrcopy. The attach-time validator shmvalidateheader checks the header scalars and region layout against the file size, but does not validate the array contents it then...

PT-2026-62064

Name of the Vulnerable Software and Affected Versions Data::RoaringBitmap::Shared versions prior to 0.02 Description This issue occurs when creating a world-readable mmap backing file and opening it without the O EXCL or O NOFOLLOW flags. The segment is created using the open function with a mode...

PT-2026-62068

Name of the Vulnerable Software and Affected Versions Data::DisjointSet::Shared versions prior to 0.02 Description This issue occurs when the software creates a world-readable mmap backing file and opens it without using the O EXCL or O NOFOLLOW flags. The segment is created in dsu.h using the op...

CVE-2026-64194

Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains. Net::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack at least with...

Updated perl-JavaScript-Minifier-XS package fixes security vulnerabilities

The updated package fixes security vulnerabilities: JavaScript::Minifier::XS versions before 0.16 for Perl crash with a NULL pointer dereference when the first meaningful token of the input is a slash. CVE-2026-56017 JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call...

EUVD-2026-46051

Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDEDERROR::decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option RFC 8914 by tokenising the raw bytes and passing the result to Perl's eval. There is some...

Updated perl-HTML-Parser packages fix security vulnerability

HTML::Entities versions before 3.84 for Perl read freed heap memory in decodeentities. CVE-2026-8829...

MGASA-2026-0263 Updated perl-Config-IniFiles package fixes a security vulnerability

The updated package fixes a security vulnerability: Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open of the -file argument in makefilehandle. CVE-2026-11527...

[SECURITY] Fedora 44 Update: perl-HTTP-Date-6.08-1.fc44

This module provides functions that deal the date formats used by the HTTP protocol and then some more. Only the first two functions, time2str and str2time, are exported by default...

OPENSUSE-SU-2026:11299-1 perl-YAML-Syck-1.470.0-1.1 on GA media

These are all security issues fixed in the perl-YAML-Syck-1.470.0-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-57075

YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syckbase64dec. The base64 decoder in the bundled libsyck indexes the 256-entry static table b64xtable with a signed char, so any !!binary byte = 0x80 sign-extends to a negative index and...