Loading story…
The CPAN Security Group disclosed two memory-safety vulnerabilities affecting widely used Perl modules. CVE-2026-7040 impacts Text::Minify::XS from v0.3.0 before v0.7.8, where malformed UTF-8 input can trigger a heap overflow in the minify and minify_utf8 functions, leading to heap corruption through improper Unicode handling. Maintainers advised users to upgrade to v0.7.8 or later, and said deployments that cannot patch immediately should validate strings before passing them to the affected routines.
A separate advisory, CVE-2026-7111, affects Text::CSV_XS before 1.62 and stems from a use-after-free when registered callbacks extend the Perl argument stack. The bug arises because methods including Parse, print, getline, and getline_all may retain a stale stack pointer across callback execution, creating a path to type confusion, memory corruption, crashes, or logic errors. The issue does not affect Text::CSV_XS instances that do not use registered callbacks, and the fix was released in version 1.62 after a public patch and CPAN publication.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Version 1.62 of Text::CSV_XS was published to CPAN with a fix for CVE-2026-7111. The advisory noted that deployments without registered callbacks were not affected.
CVE-2026-7111 was reserved for the Text::CSV_XS use-after-free vulnerability. The issue can lead to type confusion, memory corruption, logic errors, or crashes when registered callbacks trigger Perl stack reallocation.
A corrected Text::Minify::XS release, version 0.7.8, was uploaded to CPAN to fix CVE-2026-7040. Users were advised to upgrade or validate strings passed to the affected functions as a workaround.
A public patch was committed for CVE-2026-7111 in Text::CSV_XS, addressing a use-after-free caused by callbacks that extend the Perl argument stack. The bug affected methods including parse, print, getline, and getline_all in versions before 1.62.
The CPAN Security Group identified CVE-2026-7040 in Text::Minify::XS, affecting versions from 0.3.0 before 0.7.8. The flaw is a heap overflow triggered by malformed UTF-8 input in the minify and minify_utf8 functions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourceseclists.org
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security disclosures identified three vulnerabilities in widely used Perl minifier modules, including two denial-of-service flaws in **`JavaScript::Minifier::XS`** and a memory leak in **`CSS::Minifier::XS`**. **`CVE-2026-56017`** affects `JavaScript::Minifier::XS` versions before `0.16` and can crash a calling process when the first meaningful token in input is a slash, triggering a NULL pointer dereference and out-of-bounds read through the public `minify()` API. **`CVE-2026-56018`** also affects versions before `0.16`, causing a memory leak on every `minify()` call that can drive unbounded memory growth in long-lived services that process untrusted or third-party JavaScript.
Jul 12, 2026
Security advisories disclosed **CVE-2024-14031** and **CVE-2024-14030** in the Perl packages **`Sereal::Encoder`** and **`Sereal::Decoder`**, affecting versions **4.000 through 4.009_002**. Both modules embed a vulnerable version of the **Zstandard (`zstd`)** library and inherit **CVE-2019-11922**, a buffer overwrite flaw in one-pass compression functions present in zstd versions prior to **1.3.8**. The underlying issue is a race condition that can trigger **out-of-bounds writes** when an undersized output buffer is used, and the advisories classify the exposure as **CWE-1395: dependency on a vulnerable third-party component**. Maintainers advised users to upgrade both Perl modules to **version 4.010 or later** to remove the vulnerable bundled library.
Jun 29, 2026
The Perl `DBI` project released a series of updates that fixed multiple security flaws across `DBI` and related components including `DBI::SQL::Nano`, `DBD::File`, and `DBI::ProfileData`. The changelog for versions `1.648`, `1.650`, and `1.651` lists fixes for `CVE-2026-9698`, `CVE-2026-10879`, `CVE-2026-14380`, `CVE-2026-14739`, `CVE-2026-14740`, `CVE-2026-15043`, `CVE-2026-15392`, `CVE-2026-60081`, and `CVE-2026-60082`, reflecting a broad hardening effort across the database interface stack. The patched issues include code injection, out-of-bounds reads, buffer and stack overflows, path traversal or symlink problems, and limits around placeholder parsing. One of the referenced weakness classes is **CWE-134**, `Use of Externally-Controlled Format String`, underscoring the memory-safety and input-handling risks addressed in the releases. Organizations using Perl applications that depend on `DBI` or its file- and SQL-related modules should prioritize upgrading to the latest fixed versions and review exposed components for unsafe input handling and file access patterns.
Jul 14, 2026