USN-8675-2: Perl vulnerabilities
Ubuntu issued USN-8675-2 fixing two Perl flaws (CVE-2026-12087, CVE-2026-13221) enabling information disclosure and regex-based security bypass on 26.04 LTS.
Ubuntu released USN-8675-2, extending the fixes from USN-8675-1 to Perl packages on Ubuntu 26.04 LTS. The update addresses CVE-2026-12087, an out-of-bounds heap read in the Socket module when handling short source addresses, which could lead to information disclosure. It also fixes CVE-2026-13221, where regular expressions containing many fixed string alternatives could produce incorrect matches and bypass security restrictions. No exploitation is reported in the notice.
- USN-8675-2 backports Perl security fixes to Ubuntu 26.04 LTS.
- CVE-2026-12087: out-of-bounds heap read in the Socket module may disclose information.
- CVE-2026-13221: regexes with many fixed string alternatives can bypass security restrictions.
- Administrators should install the updated Perl packages.
- Products
- Perl
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-12087 | Socket versions before 2.041 for Perl have an out-of-bounds heap read | 9.1 | <1% | ||
| CVE-2026-13221 | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an… | 9.1 | <1% |
From the original article
USN-8675-1 fixed vulnerabilities in Perl. This update provides the corresponding fix for Perl on Ubuntu 26. 04 LTS.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.