CVE-2026-8796: Sereal::Decoder versions before 5.005 for Perl allow heap out-of-bounds read via crafted input

Security readout for executives and security teams

Sereal::Decoder for Perl can read memory outside the supplied input when parsing specially crafted serialized data. In affected versions before 5.005, this may expose sensitive heap data or crash the process. The issue matters most where services decode Sereal data influenced by users, partners, queues, caches, or network inputs. Exposure is likely limited to Perl applications using Sereal::Decoder before 5.005 and decoding attacker-influenced Sereal payloads. Systems that only process trusted, internally generated serialized data have lower practical exposure, but should still update because dependency boundaries often change over time. Treat this as a high-priority dependency update for any Perl service that processes Sereal data from outside a fully trusted boundary. Prioritize internet-facing, partner-facing, queue-consuming, and multi-tenant services first. No source in the bundle confirms active exploitation. Mitigation focus: Upgrade Sereal::Decoder or Sereal-Decoder to version 5.005 or later.; Identify services that decode Sereal data from users, partners, queues, caches, or network inputs.; Reject or isolate untrusted Sereal payloads until the patched dependency is deployed..

Prepared

Jun 2, 2026, 00:54 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.