login

Date Index - September 2026 - CPANSec CVE announcements

01 Sep 2026 23:23 UTC CVE-2026-81928: Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record Timothy Legge
04 Sep 2026 12:22 UTC CVE-2026-82309: Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per validation via a forward-confirmation loop that does not bound the names it queries Robert Rothenberg
06 Sep 2026 17:48 UTC CVE-2026-86219: Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step Timothy Legge
06 Sep 2026 22:25 UTC CVE-2026-86304: MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor Timothy Legge
07 Sep 2026 18:28 UTC CVE-2026-86287: Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths Robert Rothenberg
07 Sep 2026 18:40 UTC CVE-2026-16028: Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream_state never removes from the connection stream table Robert Rothenberg
08 Sep 2026 20:11 UTC CVE-2026-19872: HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message Robert Rothenberg
08 Sep 2026 20:12 UTC CVE-2026-85484: HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escaping Robert Rothenberg
08 Sep 2026 20:13 UTC CVE-2026-85485: HTML::FormHandler versions before 0.410002 for Perl render some error messages into HTML without escaping Robert Rothenberg
08 Sep 2026 20:14 UTC CVE-2026-85630: HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the process_attrs method Robert Rothenberg
17 Sep 2026 21:25 UTC CVE-2026-73639: Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG with a tRNS transparency chunk in read_direct8 Stig Palmquist
17 Sep 2026 21:27 UTC CVE-2026-73638: Imager versions from 0.45_02 before 1.035 for Perl read outside the EXIF block via unchecked start offsets in tiff_load_ifd Stig Palmquist
18 Sep 2026 14:00 UTC CVE-2026-93019: Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read Stig Palmquist
18 Sep 2026 14:03 UTC CVE-2026-93018: Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in i_gpix_p and i_glin_p Stig Palmquist
19 Sep 2026 10:47 UTC CVE-2026-78030: DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM Robert Rothenberg
19 Sep 2026 15:19 UTC CVE-2026-82560: Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width Stig Palmquist
21 Sep 2026 17:21 UTC CVE-2026-93012: Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in _sendmail_pipe Stig Palmquist
22 Sep 2026 00:54 UTC CVE-2026-93709: Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler Stig Palmquist
22 Sep 2026 00:55 UTC CVE-2026-93710: Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooks Stig Palmquist
22 Sep 2026 00:56 UTC CVE-2026-93711: Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array Stig Palmquist
22 Sep 2026 00:58 UTC CVE-2026-93712: Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler Stig Palmquist
22 Sep 2026 07:55 UTC CVE-2016-15059: Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encode_punycode Paul Johnson
22 Sep 2026 07:57 UTC CVE-2026-74765: Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode Paul Johnson
22 Sep 2026 07:58 UTC CVE-2026-74765: Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode Paul Johnson
22 Sep 2026 08:01 UTC CVE-2026-74766: Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decode_punycode Paul Johnson
22 Sep 2026 08:03 UTC CVE-2026-87078: Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycode Paul Johnson
22 Sep 2026 08:05 UTC CVE-2026-87079: Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long label in decode_punycode Paul Johnson
22 Sep 2026 08:06 UTC CVE-2026-87080: Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycode Paul Johnson
22 Sep 2026 08:07 UTC CVE-2026-87081: Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in to_ascii Paul Johnson
22 Sep 2026 08:09 UTC CVE-2026-87082: Net::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wrong label via unvalidated malformed UTF-8 in encode_punycode Paul Johnson
22 Sep 2026 18:22 UTC CVE-2026-95831: Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL Robert Rothenberg
24 Sep 2026 22:16 UTC CVE-2026-85491: Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone Robert Rothenberg
24 Sep 2026 22:39 UTC CVE-2026-97230: IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL Robert Rothenberg
25 Sep 2026 00:12 UTC CVE-2026-92288: Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying Party Timothy Legge
25 Sep 2026 00:17 UTC CVE-2026-92289: Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify the client secret Timothy Legge
25 Sep 2026 01:34 UTC CVE-2026-95811: Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it Timothy Legge
28 Sep 2026 16:05 UTC CVE-2026-88815: DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv Robert Rothenberg
28 Sep 2026 16:06 UTC CVE-2026-88816: DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName Robert Rothenberg
28 Sep 2026 16:10 UTC CVE-2026-85644: XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference Robert Rothenberg
30 Sep 2026 15:22 UTC CVE-2026-80490: Algorithm::AhoCorasick::XS versions through 0.04 for Perl read the haystack string length before the scalar is stringified Robert Rothenberg