Loading story…
An oss-sec advisory highlighted CVE-2017-20230 in Perl's Storable module, where versions before 3.05 contain a stack-based buffer overflow in retrieve_hook. The flaw occurs because a class-name length is stored in a signed integer and later handled as unsigned during read operations, allowing crafted serialized data to trigger the overflow. The issue was patched shortly after disclosure and fixed in Storable 3.05, with later inclusion in Perl through newer bundled releases.
Follow-up discussion on oss-sec questioned the practical security impact and even the usefulness of the CVE because Storable documentation already warns that it is unsafe for untrusted input. Participants pointed to earlier deserialization concerns, including CVE-2015-1592, and debated whether malformed local Storable files should continue to receive CVE treatment given the module's longstanding security warning and lack of a safe mode for hostile data.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
On 2026-04-21, oss-sec participants revisited CVE-2017-20230 and questioned its practical significance because Storable documentation already warns it is unsafe for untrusted input. The discussion referenced prior related concerns such as CVE-2015-1592 and debated whether assigning a CVE was meaningful in this context.
The issue was later assigned the identifier CPANSA-Storable-2017-01 on 2018-10-06. This formalized the advisory record for the Storable vulnerability.
The vulnerability was addressed in the release of Storable 3.05 on 2017-01-29. Users were advised to upgrade to version 3.05 or newer.
A fix for the Storable stack overflow issue was made on 2017-01-25. The remediation corrected the length-handling bug that could be triggered by crafted serialized data.
A stack overflow vulnerability in Perl's Storable module was reported on 2017-01-24. The flaw was caused by retrieve_hook storing a class-name length as a signed integer and later treating it as unsigned during reads.
The Storable fix was later incorporated into Perl v5.27.9 through inclusion of Storable 3.06. This extended the remediation into the broader Perl distribution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security advisories disclosed **CVE-2024-14031** and **CVE-2024-14030** in the Perl packages **`Sereal::Encoder`** and **`Sereal::Decoder`**, affecting versions **4.000 through 4.009_002**. Both modules embed a vulnerable version of the **Zstandard (`zstd`)** library and inherit **CVE-2019-11922**, a buffer overwrite flaw in one-pass compression functions present in zstd versions prior to **1.3.8**. The underlying issue is a race condition that can trigger **out-of-bounds writes** when an undersized output buffer is used, and the advisories classify the exposure as **CWE-1395: dependency on a vulnerable third-party component**. Maintainers advised users to upgrade both Perl modules to **version 4.010 or later** to remove the vulnerable bundled library.
Jun 29, 2026
The CPAN Security Group disclosed two memory-safety vulnerabilities affecting widely used Perl modules. **CVE-2026-7040** impacts `Text::Minify::XS` from `v0.3.0` before `v0.7.8`, where malformed UTF-8 input can trigger a heap overflow in the `minify` and `minify_utf8` functions, leading to heap corruption through improper Unicode handling. Maintainers advised users to upgrade to `v0.7.8` or later, and said deployments that cannot patch immediately should validate strings before passing them to the affected routines. A separate advisory, **CVE-2026-7111**, affects `Text::CSV_XS` before `1.62` and stems from a use-after-free when registered callbacks extend the Perl argument stack. The bug arises because methods including `Parse`, `print`, `getline`, and `getline_all` may retain a stale stack pointer across callback execution, creating a path to type confusion, memory corruption, crashes, or logic errors. The issue does not affect `Text::CSV_XS` instances that do not use registered callbacks, and the fix was released in version `1.62` after a public patch and CPAN publication.
Jun 29, 2026
A heap overflow vulnerability tracked as **CVE-2026-14739** was disclosed in **DBI for Perl** versions before `1.650`. The flaw occurs during SQL statement preparsing when an attacker supplies an extreme number of placeholders, leading to an out-of-bounds write classified as **CWE-787**. The issue stems from an incomplete fix for **CVE-2026-10879**, which still failed to allocate enough memory when handling roughly **1.2 million placeholders**. The maintainers addressed the bug in **DBI `1.650`** by enforcing a hard limit of **99,999 placeholders**, preventing the oversized input condition that triggered the heap overflow. Organizations using Perl applications that rely on DBI should identify deployments running versions earlier than `1.650` and prioritize upgrades to remove exposure to malformed SQL statements that could crash processes or potentially enable further exploitation.
Aug 15, 2026