CVE-2020-12723

regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.

A vulnerability in the Perl regular expression compiler affects Red Hat Enterprise Linux 7 and 8. The flaw exists in the S_study_chunk() function's handling of GOSUB opcodes during regular expression compilation. When processing untrusted regular expressions, recursive calls to S_study_chunk() can corrupt the intermediate language state, allowing an attacker to inject malicious instructions into the compiled regular expression. This network-accessible vulnerability can lead to denial of service. To mitigate, applications should not allow compilation of untrusted regular expressions. Note that this issue affects regular expression compilation, not pattern matching against untrusted input.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this flaw, developers should not allow untrusted regular expressions to be compiled by the Perl regular expression compiler.