Thread Index - September 2026 - CPANSec CVE announcements

CVE-2026-81928: Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record Timothy Legge (01 Sep 2026 23:23 UTC)
CVE-2026-82309: Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per validation via a forward-confirmation loop that does not bound the names it queries Robert Rothenberg (04 Sep 2026 12:22 UTC)
CVE-2026-86219: Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step Timothy Legge (06 Sep 2026 17:48 UTC)
CVE-2026-86304: MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor Timothy Legge (06 Sep 2026 22:25 UTC)
CVE-2026-86287: Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths Robert Rothenberg (07 Sep 2026 18:28 UTC)
CVE-2026-16028: Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream_state never removes from the connection stream table Robert Rothenberg (07 Sep 2026 18:40 UTC)
CVE-2026-19872: HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message Robert Rothenberg (08 Sep 2026 20:11 UTC)
CVE-2026-85484: HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escaping Robert Rothenberg (08 Sep 2026 20:12 UTC)
CVE-2026-85485: HTML::FormHandler versions before 0.410002 for Perl render some error messages into HTML without escaping Robert Rothenberg (08 Sep 2026 20:13 UTC)
CVE-2026-85630: HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the process_attrs method Robert Rothenberg (08 Sep 2026 20:14 UTC)