References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

Change History

http://www.openwall.com/lists/oss-security/2026/07/13/7

Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.

retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.

A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.

CWE-190

https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.patch

[{"vendor":"HAARG","product":"Storable","defaultStatus":"unaffected","collectionURL":"https://cpan.org/modules","packageName":"Storable","programFiles":["Storable.xs"],"programRoutines":[{"name":"retrieve_hook_common"}],"repo":"https://github.com/Perl/perl5","versions":[{"version":"0","lessThan":"3.41","versionType":"custom","status":"affected"}]}]