CVE-2026-13221

A flaw was found in Perl. When the Perl regular expression engine processes patterns with a very large number of alternative fixed strings, an internal data field can overflow. This leads to silently incorrect regular expression matches, causing the engine to either match strings it should not (false positives) or fail to match strings it should (false negatives). If these regular expressions are used for security-sensitive operations like access control or data filtering, this flaw could result in incorrect security decisions.

Red Hat Product Security has rated this vulnerability moderate as exploiting it requires local access as well as complex buffer overflows to get access to running arbitrary code. Also a successful attack will depend strongly on the script that is housing the vulnerable regular expression. No production script should implicitly trust data and make security decisions, so the impact for a successful exploitation is very low.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.