Perl vulnerabilities and fixes

CVEs that mention Perl, ranked by priority. 35 tracked.

Perl has 35 tracked vulnerabilities, 9 critical. A fixed release or vendor patch exists for 22. Most recent: 2026-10-24. Highest priority: CVE-2026-16766 (score 64/100).

• CVE-2026-16766 CRITICAL 9.8 Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render
• CVE-2026-16634 CRITICAL 9.8 TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99. The tomlc99 l
• CVE-2026-16770 CRITICAL 9.8 PDF::WebKit versions through 1.2 for Perl allow argument injection into wkhtmltopdf via meta tags in the sourc
• CVE-2026-58586 CRITICAL 9.8 Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link
• CVE-2026-66902 CRITICAL 9.8 Google::Auth versions before 0.06 for Perl run a command named in an external_account credentials JSON via an
• CVE-2026-17552 CRITICAL 9.1 Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_UR
• CVE-2026-9390 CRITICAL 9.1 UPGRADE XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify() and _get_signed_xml() in
• CVE-2026-17510 HIGH 7.5 Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute via a
• CVE-2026-18108 CRITICAL 9.8 UPGRADE Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accep
• CVE-2026-19082 HIGH 7.5 Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from
• CVE-2026-9487 CRITICAL 9.1 UPGRADE XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID. _get_signed_xml() in lib/XM
• CVE-2026-19566 HIGH 7.5 Net::CIDR::Set versions before 0.23 for Perl allow memory exhaustion and malformed set ranges via unbounded IP
• CVE-2026-60074 HIGH 7.5 Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the n
• CVE-2026-66901 HIGH 7.5 Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via u
• CVE-2026-13089 HIGH 7.5 OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlle
• CVE-2026-60075 HIGH 7.5 Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored t
• CVE-2026-17431 MEDIUM 6.1 PDF::WebKit versions through 1.2 for Perl allow OS command injection via a 2-arg open() of the output path in
• CVE-2026-18568 HIGH 7.5 UPGRADE XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns tr
• CVE-2026-18089 HIGH 7.5 UPGRADE Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the r
• CVE-2026-18092 HIGH 8.1 UPGRADE Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because n
• CVE-2025-30045 HIGH 8.6 CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl expressions into R
• CVE-2026-18536 HIGH 7.5 UPGRADE Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. The Data::Entropy::
• CVE-2026-15534 MEDIUM 5.7 Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via a
• CVE-2026-17435 LOW 2.5 File::Rotate::Simple versions before 0.4.0 for Perl create the target of dangling symlinks when rotating files
• CVE-2026-113877 HIGH n/a HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matche
• CVE-2026-94423 HIGH n/a Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks t
• CVE-2026-94140 HIGH n/a Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync ha
• CVE-2026-108518 HIGH n/a DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed
• CVE-2026-112202 HIGH n/a Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images. Wit
• CVE-2026-112921 HIGH n/a Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent
• CVE-2026-113811 HIGH n/a Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared
• CVE-2026-85783 HIGH n/a Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient stanzas, e
• CVE-2026-111879 HIGH n/a DBI versions before 1.656 for Perl hang on a later open of a DBD::DBM table because a failed open_data does no
• CVE-2026-113812 HIGH n/a Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to comp
• CVE-2026-114629 HIGH n/a Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded

FAQ

How do I fix Perl vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Perl being exploited right now?

None of the tracked Perl CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Perl CVE should I patch first?

CVE-2026-16766 currently ranks highest (64/100): Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render .

← Back to latest CVEs