CVE-2024-56406
- Source
- https://cve.org/CVERecord?id=CVE-2024-56406
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-56406.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-56406
- Downstream
- Related
- Published
- 2025-04-13T13:16:09.841Z
- Modified
- 2026-08-12T15:13:11.307579Z
- Severity
-
- 8.4 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Perl is vulnerable to a heap buffer overflow when transliterating non-ASCII bytes
- Details
-
A heap buffer overflow vulnerability was discovered in Perl.
Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10.
When there are non-ASCII bytes in the left-hand-side of the
troperator,S_do_trans_invmapcan overflow the destination pointerd.$ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;' Segmentation fault (core dumped)
It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses.
- Database specific
{ "cna_assigner": "CPANSec", "cwe_ids": [ "CWE-122", "CWE-787" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56406.json" }- References
-
- http://www.openwall.com/lists/oss-security/2025/04/13/3
- http://www.openwall.com/lists/oss-security/2025/04/13/4
- http://www.openwall.com/lists/oss-security/2025/04/13/5
- https://cpan.org/modules
- https://github.com/Perl/perl5/
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56406.json
- https://metacpan.org/release/SHAY/perl-5.38.4/changes
- https://metacpan.org/release/SHAY/perl-5.40.2/changes
- https://nvd.nist.gov/vuln/detail/CVE-2024-56406
- https://github.com/Perl/perl5/commit/87f42aa0e0096e9a346c9672aa3a0bd3bef8c1dd.patch
Affected packages
Git / github.com/perl/perl5
Affected ranges
- Type
- GIT
- Repo
- https://github.com/perl/perl5
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "introduced": "5.33.1" }, { "fixed": "5.38.4" }, { "introduced": "5.39.0" }, { "fixed": "5.40.2" }, { "introduced": "5.41.0" }, { "last_affected": "5.41.10" } ], "source": [ "CPE_RANGE", "REFERENCES" ], "cpe": "cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:*" }
Affected versions
v5.*
v5.33.1
v5.33.2
v5.33.3
v5.33.4
v5.33.7
v5.33.8
v5.33.9
v5.34.0
v5.34.0-RC1
v5.34.0-RC2
v5.35.0
v5.35.10
v5.35.11
v5.35.3
v5.35.5
v5.35.6
v5.35.8
v5.35.9
v5.36.0
v5.36.0-RC3
v5.37.0
v5.37.1
v5.37.10
v5.37.11
v5.37.2
v5.37.3
v5.37.4
v5.37.5
v5.37.6
v5.37.7
v5.37.9
v5.38.0
v5.38.0-RC1
v5.38.0-RC2
v5.38.1
v5.38.2
v5.38.3
v5.38.3-RC1
v5.38.4-RC1
v5.39.0
v5.39.1
v5.39.3
v5.39.4
v5.39.5
v5.39.7
v5.39.8
v5.40.0
v5.40.0-RC1
v5.40.0-RC2
v5.40.1
v5.40.1-RC1
v5.40.2-RC1
v5.41.0
v5.41.1
v5.41.10
v5.41.2
v5.41.3
v5.41.4
v5.41.5
v5.41.7
v5.41.8
v5.41.9
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-56406.json"
vanir_signatures
[
{
"target": {
"function": "S_pmtrans",
"file": "op.c"
},
"deprecated": false,
"source": "https://github.com/perl/perl5/commit/87f42aa0e0096e9a346c9672aa3a0bd3bef8c1dd",
"id": "CVE-2024-56406-17f9d390",
"signature_version": "v1",
"digest": {
"length": 13728.0,
"function_hash": "103498168550110636723907425407205223783"
},
"signature_type": "Function"
},
{
"target": {
"file": "op.c"
},
"deprecated": false,
"source": "https://github.com/perl/perl5/commit/87f42aa0e0096e9a346c9672aa3a0bd3bef8c1dd",
"id": "CVE-2024-56406-eaa69e21",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"189586818232990660262111173185107192330",
"321624929067096723080303988807375853448",
"308843707930518695019406321178223426241",
"156431593218724535804723157254102277155"
]
},
"signature_type": "Line"
}
]
vanir_signatures_modified
"2026-08-12T15:13:11Z"