CVE-2024-56406

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-56406
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-56406.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-56406
Downstream
ALPINE (1)
ALSA (1)
AZL (2)
BELL (1)
DEBIAN (1)
MGASA (1)
MINI (3)
OESA (4)
openSUSE (1)
RHSA (1)
RLSA (1)
SUSE (2)
UBUNTU (1)
Related
ALSA (1)
openSUSE (1)
SUSE (2)
Published
2025-04-13T13:16:09Z
Modified
2026-10-28T10:42:12Z
Severity
  • 8.4 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Perl is vulnerable to a heap buffer overflow when transliterating non-ASCII bytes
Details

A heap buffer overflow vulnerability was discovered in Perl.

Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10.

When there are non-ASCII bytes in the left-hand-side of the tr operator, S_do_trans_invmap can overflow the destination pointer d.

   $ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;'    Segmentation fault (core dumped)

It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses.

Database specific 
{
    "cna_assigner": "CPANSec",
    "cwe_ids": [
        "CWE-122",
        "CWE-787"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56406.json"
}
References

Affected packages

Git / github.com/perl/perl5

Affected ranges

Type
GIT
Repo
https://github.com/perl/perl5
Events
Introduced
b69b5077393db9b8ffa440eba15b27073cbac617
Fixed
546f65a086129e4158cff53a40c724d6952f3ed6
Introduced
aec03eb052e5786cf01d615cc5eb8e3d528c0fcd
Fixed
2e0f6a60c12ff9b5fd18e5a18d350b4366ea12b7
Introduced
e8cce44acbf725a386d6645647073769caab1f34
Fixed
87f42aa0e0096e9a346c9672aa3a0bd3bef8c1dd
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "5.33.1"
                },
                {
                    "fixed": "5.38.4"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "5.39.0"
                },
                {
                    "fixed": "5.40.2"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "5.41.0"
                },
                {
                    "last_affected": "5.41.10"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "range": [
                {
                    "fixed": "87f42aa0e0096e9a346c9672aa3a0bd3bef8c1dd"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v5.*
v5.33.1
v5.33.2
v5.33.3
v5.33.4
v5.33.7
v5.33.8
v5.33.9
v5.34.0
v5.34.0-RC1
v5.34.0-RC2
v5.35.0
v5.35.10
v5.35.11
v5.35.3
v5.35.5
v5.35.6
v5.35.8
v5.35.9
v5.36.0
v5.36.0-RC3
v5.37.0
v5.37.1
v5.37.10
v5.37.11
v5.37.2
v5.37.3
v5.37.4
v5.37.5
v5.37.6
v5.37.7
v5.37.9
v5.38.0
v5.38.0-RC1
v5.38.0-RC2
v5.38.1
v5.38.2
v5.38.3
v5.38.3-RC1
v5.38.4-RC1
v5.39.0
v5.39.1
v5.39.3
v5.39.4
v5.39.5
v5.39.7
v5.39.8
v5.40.0
v5.40.0-RC1
v5.40.0-RC2
v5.40.1
v5.40.1-RC1
v5.40.2-RC1
v5.41.0
v5.41.1
v5.41.10
v5.41.2
v5.41.3
v5.41.4
v5.41.5
v5.41.7
v5.41.8
v5.41.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-56406.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "103498168550110636723907425407205223783",
            "length": 13728
        },
        "id": "CVE-2024-56406-17f9d390",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/perl/perl5/commit/87f42aa0e0096e9a346c9672aa3a0bd3bef8c1dd",
        "target": {
            "file": "op.c",
            "function": "S_pmtrans"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "189586818232990660262111173185107192330",
                "321624929067096723080303988807375853448",
                "308843707930518695019406321178223426241",
                "156431593218724535804723157254102277155"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-56406-eaa69e21",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/perl/perl5/commit/87f42aa0e0096e9a346c9672aa3a0bd3bef8c1dd",
        "target": {
            "file": "op.c"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T10:42:12Z"