DateTime::Lite before 0.8.1 allows CPU exhaustion (CVE-2026-87768)
Adding seconds can trigger a per-day loop in the Perl module; 0.8.1 is the fixed version named in the notice.
Stories per day · 30 days
2 RSS
Relatedperl4code-execution1cpu-exhaustion1datetime-lite1denial-of-service1host-key1jq-lite1libssh1robots-validate1ssh1string-eval1user-agent1
11 stories, newest first · one card per story
Stories tagged #cpan
Robots::Validate before 0.4.10 mislabels clients as robots (CVE-2026-112921)
User-Agent matcher state from an earlier request can make the next client look like an imposter robot.
Net::LibSSH before 0.004 skips SSH host-key checks (CVE-2026-94423)
connect() never compares the server host key with known_hosts, so the client can accept an unverified server.
JQ::Lite before 2.51 executes Perl from query regexes (CVE-2026-78497)
The Perl module compiles a query regular expression with string eval, running embedded Perl code.
CVE-2026-80490: Algorithm::AhoCorasick::XS versions through 0.04 for Perl read the haystack string length before the scalar is stringified
CVE-2026-80490 in Perl's Algorithm::AhoCorasick::XS through 0.04 reads haystack length before scalar stringification, causing incorrect search behavior.
CVE-2026-95811: Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it
Lemonldap::NG::Handler lets equivalent path spellings bypass locationRules before fixed releases (CVE-2026-95811).
CVE-2026-97230: IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL
Malicious Perl package IO::Socket::SSL::SelfCertificate 1.00 (CVE-2026-97230) executes Python from an obfuscated URL.
Re: CVE-2026-95831: Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL
CPAN removed Crypt::SelfCertificate 1.01–1.05 after CVE-2026-95831 identified a Python dropper.
Re: CVE-2026-95831: Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL
CVE-2026-95831: malicious Crypt::SelfCertificate 1.01–1.05 runs Python from an obfuscated URL.
CVE-2026-95831: Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL
Crypt::SelfCertificate 1.01–1.05 for Perl contains malware that runs Python from an obfuscated URL.
CVE-2026-87080: Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycode
Net::IDN::Punycode::PP Perl module before 2.590 decodes truncated punycode labels into names containing characters that were never encoded.