CVE-2026-13221 is a critical flaw (CVSS 9.1) in Perl. A regular expression with more than 65535 fixed string alternatives overflows a 16-bit field while compiling, and the match table is silently truncated. The result is wrong matches. The fix is in Perl 5.43.10 and the maintenance releases named below.
What's affected
The record lists these Perl versions as affected:
- before 5.40.5-RC1 on the 5.40 line
- from 5.41.0 before 5.42.3-RC1
- from 5.43.0 before 5.43.10
The CPAN Security Group announcement on oss-security says the fix is in the 5.43.10 development release and tells readers to apply the upstream patch. For the stable lines, the record names the 5.40.5 and 5.42.3 release candidates as the first fixed points. Confirm the final release numbers with your Perl source or your distribution vendor.
Perl ships inside many things beyond a perl install. Operating system images, Docker base images, build tools and scripts all carry it, so the version you care about may be inside a container layer rather than on a host. Distribution vendors often backport fixes without changing the upstream version number, so check the vendor advisory for your distribution as well as the number printed by perl -v.
How to check if you're exposed
Check your Perl version:
perl -v
perl -e 'print "$]\n"'
The condition is narrow. You are only affected in practice if your code builds one regex out of more than 65535 literal alternatives, for example a very large block list or word list joined with a pipe, and uses that regex for a decision. If you do not build patterns that big, the bug does not trigger. Search your code for large generated patterns and for modules that build regexes from big lists.
To look for large generated patterns, search for code that joins a list into a regex. Typical shapes are a join of an array with a pipe, passed to the regex engine, or a loaded file of words turned into one pattern. Count the entries at runtime in a test run. Anything over 65535 literal entries is in the affected shape.
If you maintain scripts that filter logs, block spam words or match known bad strings, look there first. Those are the uses where a huge list is common.
What to do now
- Run perl -v on every host and container image that ships Perl.
- Upgrade to a fixed release, or apply the upstream patch referenced in the advisory.
- Find regexes built from very large literal lists and count the alternatives.
- If you cannot upgrade, split big lists into several smaller patterns or use a hash lookup for exact string membership.
- Retest any allow or deny decisions that depended on such a pattern, since earlier results may have been wrong.
- Add a test that checks a known member of a large list still matches after any change, so a silent failure shows up in CI.
Why it matters
The bug is an integer overflow. Perl compiles a set of literal alternatives into a trie. The distance between the first branch and the shared tail is stored in 16 bits. At 65536 branches the value wraps, the decision table is cut short and Perl reports nothing.
The danger is quiet failure. A false positive can allow what you meant to block, and a false negative can block what you meant to allow. When a pattern gates access or filters input, the answer is simply wrong. The record does not flag this CVE as known exploited.
The general lesson is to treat a regex built from a very large list as a data structure, not as a pattern. A hash set gives exact membership and cannot overflow a 16-bit field.
The record lists this weakness class: CWE-190 (Integer Overflow or Wraparound).
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to worry if my regexes are small?
No. The trigger is an alternation of more than 65535 fixed strings. Small patterns do not reach the overflow.
Is there a runtime error to look for?
No. The advisory says the match table is truncated with no warning or error, so you have to find the pattern by reading code.
How would I know if I was bitten by this?
You would not see an error. The only sign is wrong results, a string that should match and does not, or the reverse. Tests with known members of the list are the way to catch it.
Sources
Last reviewed: 19 October 2026.
