AZL-92415
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-92415.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-92415
- Upstream
- Published
- 2026-07-13T17:17:55Z
- Modified
- 2026-08-30T05:26:50Z
- Summary
- CVE-2026-57433 affecting package perl for versions less than 5.38.2-514
- Details
-
Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.
retrievehookcommon reads a signed 32-bit item count from an SXHOOK record and calls avextend with that count plus one. A count of I32_MAX wraps the addition to a negative value.
A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.
- References