Security readout for executives and security teams
Plain-English summary
Perl can make incorrect allow, deny, or filtering decisions when processing an unusually large regular expression containing more than 65,535 fixed-string alternatives. It may accept text that should fail or reject text that should pass, without warning. Business risk is greatest where such generated patterns enforce authorization, security filtering, routing, or availability controls.
Executive priority
Prioritize rapid investigation because silent security-decision errors can evade monitoring and affect integrity or availability. Immediate emergency patching is most justified for internet-reachable or security-critical services that generate very large regex rule sets. Other Perl deployments should follow normal expedited patching after confirming version exposure and application pattern shape.
Technical view
In affected Perl releases, Perl_study_chunk compiles large fixed-string alternations into a trie. A branch-to-tail delta stored in a 16-bit field overflows above 65,535 branches, silently truncating the match-decision table. Resulting regex evaluation can produce false positives and false negatives, potentially compromising integrity and availability when matches control security-sensitive behavior.
Likely exposure
Exposure is conditional and probably concentrated in systems that generate exceptionally large regular expressions, such as rule aggregation or filtering engines. Ordinary expressions below the branch threshold are not implicated by the supplied evidence. Inventory Perl versions and identify applications constructing fixed-string alternations exceeding 65,535 branches, especially where results drive access or filtering decisions.
Exploitation context
The CVSS assessment is 9.1, with network-reachable, low-complexity, unauthenticated impact assumed. However, the supplied sources do not establish public exploitation or inclusion in CISA KEV; KEV is explicitly false. Practical abuse also requires reaching a vulnerable application path that compiles the unusually large regex shape and relies on its result.
Researcher notes
The defect is CWE-190 integer overflow involving a 16-bit trie offset, not general regex backtracking. Reproduction analysis should focus on alternations exceeding 65,535 fixed strings with a shared tail and compare expected positive and negative cases. The supplied evidence identifies incorrect matching but does not quantify affected applications, real-world reachability, or observed attacks.
Mitigation direction
- Upgrade to a vendor-supported Perl release containing the upstream correction.
- For affected maintained packages, obtain the appropriate backport from the operating-system or Perl distributor.
- Review the upstream patch and vendor guidance before applying changes.
- Temporarily avoid security decisions based on regexes exceeding 65,535 fixed-string branches.
- Add an explicit branch-count limit or fail-closed safeguard where applications generate large patterns.
Validation and detection
- Record runtime and packaged Perl versions across exposed systems.
- Identify code or data pipelines that generate large fixed-string regex alternations.
- Test representative patterns above 65,535 branches for expected positive and negative matches.
- Confirm patched environments return correct results without silent truncation.
- Regression-test authorization, filtering, routing, and denial paths that depend on generated regexes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-190: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-13221 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H3.95.2CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patchCVE reference, CPANSec · patch
- https://github.com/Perl/perl5/issues/23388CVE reference, CPANSec · issue-tracking
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Integer Overflow or Wraparound
Integer Overflow or Wraparound represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.