How many CVEs have a located fix in Perl/perl5?

15 published CVEs have a fix traced to functions in Perl/perl5, touching 79 functions across 32 files.

Which function in Perl/perl5 has been patched by the most CVEs?

address in cpan/Socket/Socket.pm has been changed by 1 CVE fixes, from 2026 to 2026.

How large is a typical CVE fix in Perl/perl5?

The median fix changes 10 lines. 60% of fixes change 20 lines or fewer, and 73% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

c

perl

#381 of 500 repositories

Perl/perl5

Name: Perl/perl5: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix August 13, 2026

15

CVE fixes located

Published CVEs

79

Functions patched

Distinct function sites

32

Files patched

Distinct source files

2018–2026

Years covered

By CVE publication date

Overview

15 published CVEs have a fix traced to functions in Perl/perl5, the earliest published in 2018. Those fixes changed 79 distinct functions across 32 files, in 705 patch hunks.

Among the 500 repositories tracked here, Perl/perl5 ranks #381 by the number of CVEs with a located fix.

Most patched functions

Functions in Perl/perl5 changed by the most CVE fixes.

Most patched files

Files in Perl/perl5 changed by the most CVE fixes.

1regcomp.c5 CVEs · 3 functions
2Porting/Maintainers.pl2 CVEs · 0 functions
3regcomp_study.c2 CVEs · 0 functions
4cpan/Compress-Raw-Zlib/zlib-src/zlib.h1 CVEs · 18 functions
5cpan/Compress-Raw-Zlib/zlib-src/deflate.c1 CVEs · 14 functions
6cpan/Compress-Raw-Zlib/zlib-src/trees.c1 CVEs · 9 functions
7cpan/Compress-Raw-Zlib/zlib-src/crc32.c1 CVEs · 8 functions
8cpan/Compress-Raw-Zlib/zlib-src/inflate.c1 CVEs · 7 functions
9cpan/Socket/Socket.pm1 CVEs · 4 functions
10cpan/Compress-Raw-Zlib/zlib-src/infback.c1 CVEs · 3 functions

Fix size

How much code a CVE fix in Perl/perl5 changes, with backports counted once.

10

Median lines changed

Added plus removed, per CVE

60%

Fixes of 20 lines or fewer

Share of CVE fixes

73%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in Perl/perl5, and the functions each fix changed.

Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass
CVE-2026-19487
Medium · CVSS 5.3
EPSS 0.4%2026-08-13
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk
CVE-2026-13221
Critical · CVSS 9.1
EPSS 0.4%2026-07-13
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack
CVE-2026-57432
High · CVSS 8.4
EPSS 0.2%2026-07-13
Socket versions before 2.041 for Perl have an out-of-bounds heap read
CVE-2026-12087address structure string
Critical · CVSS 9.1
EPSS 0.4%2026-06-15
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds
CVE-2026-8376
Critical · CVSS 9.8
EPSS 0.5%2026-05-25
Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib
CVE-2026-4176fixedtables buildtables once_s
Critical · CVSS 9.8
EPSS 0.8%2026-03-29
Perl threads have a working directory race condition where file operations may target unintended paths
CVE-2025-40909
Medium · CVSS 5.9
EPSS 0.5%2025-05-30
Perl is vulnerable to a heap buffer overflow when transliterating non-ASCII bytes
CVE-2024-56406
High · CVSS 8.4
EPSS 0.5%2025-04-13
CVE-2021-36770
CVE-2021-36770
High · CVSS 7.8
EPSS 1.4%2021-08-11
CVE-2020-12723
CVE-2020-12723isALPHA_A minimum S_ssc_union
High · CVSS 7.5
EPSS 6.0%2020-06-05
CVE-2020-10878
CVE-2020-10878
High · CVSS 8.6
EPSS 4.9%2020-06-05
CVE-2020-10543
CVE-2020-10543
High · CVSS 8.2
EPSS 11.3%2020-06-05

Get an alert for each new Perl/perl5 CVE, with the patched functions and AI-written analysis.

Monitor perl5 CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

0xJacky/nginx-ui15 CVEs apache/mynewt-nimble15 CVEs cubecart/v615 CVEs debian/busybox15 CVEs debian/libsoup315 CVEs debian/zziplib15 CVEs decolua/9router15 CVEs DSpace/DSpace15 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in Perl/perl5.

How many CVEs have a located fix in Perl/perl5?: 15 published CVEs have a fix traced to functions in Perl/perl5, touching 79 functions across 32 files.
Which function in Perl/perl5 has been patched by the most CVEs?: address in cpan/Socket/Socket.pm has been changed by 1 CVE fixes, from 2026 to 2026.
How large is a typical CVE fix in Perl/perl5?: The median fix changes 10 lines. 60% of fixes change 20 lines or fewer, and 73% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track Perl/perl5 CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing