CVE-2026-13221
Description
A flaw was found in Perl. When the Perl regular expression engine processes patterns with a very large number of alternative fixed strings, an internal data field can overflow. This leads to silently incorrect regular expression matches, causing the engine to either match strings it should not (false positives) or fail to match strings it should (false negatives). If these regular expressions are used for security-sensitive operations like access control or data filtering, this flaw could result in incorrect security decisions.
Statement
Red Hat Product Security has rated this vulnerability moderate as exploiting it requires local access as well as complex buffer overflows to get access to running arbitrary code. Also a successful attack will depend strongly on the script that is housing the vulnerable regular expression. No production script should implicitly trust data and make security decisions, so the impact for a successful exploitation is very low.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.9 | 9.1 | 9.1 |
| Attack Vector | Network | Network | Network |
| Attack Complexity | High | Low | Low |
| Privileges Required | Low | None | None |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | Low | None | None |
| Integrity Impact | High | High | High |
| Availability Impact | None | High | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
