OESA-2026-2846

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-2846

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2026-2846.json

JSON Data

https://api.osv.dev/v1/vulns/OESA-2026-2846

Upstream

CVE-2026-12087

Published

2026-07-06T06:27:55Z

Modified

2026-07-06T06:45:13.870318667Z

Summary

perl security update

Details

Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects.

Security Fix(es):

Socket versions before 2.041 for Perl have an out-of-bounds heap read.

In Socket.xs, packipmreqsource() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imrsourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.

Calling packipmreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.(CVE-2026-12087)

Database specific

{
    "severity": "Critical"
}

References

Affected packages

openEuler:20.03-LTS-SP4 / perl

Package

Name: perl
Purl: pkg:rpm/openEuler/perl&distro=openEuler-20.03-LTS-SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.28.3-13.oe2003sp4

Ecosystem specific

{
    "aarch64": [
        "perl-5.28.3-13.oe2003sp4.aarch64.rpm",
        "perl-debuginfo-5.28.3-13.oe2003sp4.aarch64.rpm",
        "perl-debugsource-5.28.3-13.oe2003sp4.aarch64.rpm",
        "perl-devel-5.28.3-13.oe2003sp4.aarch64.rpm",
        "perl-libs-5.28.3-13.oe2003sp4.aarch64.rpm"
    ],
    "noarch": [
        "perl-help-5.28.3-13.oe2003sp4.noarch.rpm"
    ],
    "x86_64": [
        "perl-5.28.3-13.oe2003sp4.x86_64.rpm",
        "perl-debuginfo-5.28.3-13.oe2003sp4.x86_64.rpm",
        "perl-debugsource-5.28.3-13.oe2003sp4.x86_64.rpm",
        "perl-devel-5.28.3-13.oe2003sp4.x86_64.rpm",
        "perl-libs-5.28.3-13.oe2003sp4.x86_64.rpm"
    ],
    "src": [
        "perl-5.28.3-13.oe2003sp4.src.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-2846.json"