Loading story…
Security advisories disclosed CVE-2024-14031 and CVE-2024-14030 in the Perl packages Sereal::Encoder and Sereal::Decoder, affecting versions 4.000 through 4.009_002. Both modules embed a vulnerable version of the Zstandard (zstd) library and inherit CVE-2019-11922, a buffer overwrite flaw in one-pass compression functions present in zstd versions prior to 1.3.8.
The underlying issue is a race condition that can trigger out-of-bounds writes when an undersized output buffer is used, and the advisories classify the exposure as CWE-1395: dependency on a vulnerable third-party component. Maintainers advised users to upgrade both Perl modules to version 4.010 or later to remove the vulnerable bundled library.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A security advisory disclosed CVE-2024-14031 affecting Sereal::Encoder for Perl versions 4.000 through 4.009_002. The flaw was traced to an embedded vulnerable Zstandard library version affected by CVE-2019-11922, and users were advised to upgrade to version 4.010 or later.
A CPAN Security Group advisory disclosed CVE-2024-14030 affecting Sereal::Decoder for Perl versions 4.000 through 4.009_002. The issue stems from an embedded vulnerable Zstandard library version affected by CVE-2019-11922, and users were advised to upgrade to version 4.010 or later.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Perl disclosed **CVE-2026-4176**, a vulnerability affecting releases from `5.9.4` before `5.40.4-RC1`, from `5.41.0` before `5.42.2-RC1`, and from `5.43.0` before `5.43.9`, because they shipped a vulnerable bundled version of the dual-life core module **Compress::Raw::Zlib**. The issue traces to the module’s vendored `zlib` copy, which is vulnerable to **CVE-2026-3381** and includes additional flaws such as **CVE-2026-27171**. Some operating system distributions may avoid exposure if they link Perl against a patched system `zlib` version `1.3.2` or later, or if they have backported fixes. The Perl project updated the bundled module in blead to version `2.221` and shipped fixes in **Perl 5.40.4** and **Perl 5.42.2**, which include **Compress::Raw::Zlib 2.222**. Follow-up discussion on the oss-sec mailing list clarified that remediation guidance should explicitly state that affected installations can also be fixed by installing **Compress::Raw::Zlib 2.222** from CPAN so it overrides the vulnerable core module in `@INC`; earlier guidance had noted `2.220` or later as a workaround.
Jun 29, 2026
The CPAN Security Group disclosed two memory-safety vulnerabilities affecting widely used Perl modules. **CVE-2026-7040** impacts `Text::Minify::XS` from `v0.3.0` before `v0.7.8`, where malformed UTF-8 input can trigger a heap overflow in the `minify` and `minify_utf8` functions, leading to heap corruption through improper Unicode handling. Maintainers advised users to upgrade to `v0.7.8` or later, and said deployments that cannot patch immediately should validate strings before passing them to the affected routines. A separate advisory, **CVE-2026-7111**, affects `Text::CSV_XS` before `1.62` and stems from a use-after-free when registered callbacks extend the Perl argument stack. The bug arises because methods including `Parse`, `print`, `getline`, and `getline_all` may retain a stale stack pointer across callback execution, creating a path to type confusion, memory corruption, crashes, or logic errors. The issue does not affect `Text::CSV_XS` instances that do not use registered callbacks, and the fix was released in version `1.62` after a public patch and CPAN publication.
Jun 29, 2026
A high-severity vulnerability, **CVE-2026-16235**, was disclosed in DRSTEVE's Perl module **`Crypt::Password`**, where versions through **0.28** generate password salts using Perl's built-in **`rand`** function. Because `rand` is predictable and not suitable for cryptographic use, the issue was classified as **CWE-338** and assigned a **CVSS v3.1** score with vector **`AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`**, indicating potentially severe impact if affected applications rely on the module for password handling. The disclosure said there is **no known exploitation** so far, but exploitation would be **automatable** and could have **total technical impact**. Maintainers and users were advised to avoid the module's default salt generation by supplying salts generated with a stronger source such as **`Crypt::URandom::Token`**, and to consider migrating away from `Crypt::Password` entirely because the package reportedly has not been updated since **2012**.
Jul 20, 2026