Perl
Vendor:
First CVE: Dec 31, 1999 · Active for 26 years
57
Total CVEs
More Total CVEs than 98% of tracked products
3.0
Avg CVEs / Year
Higher CVE frequency than 76% of tracked products
7.2
Avg CVSS
Higher Avg CVSS than 44% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Perl over time
Volume of CVEsAvg CVSS Base Score
First CVE
Dec 31, 1999
26 years ago
Most Recent CVE
Jul 13, 2026
11 days ago
CVE Severity & Scoring
Perl57 CVEs
32%
42%
23%
All CVEs352,231 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local9 (15.8%)
Network24 (42.1%)
Unknown24 (42.1%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low31 (54.4%)
High2 (3.5%)
Unknown24 (42.1%)
User Interaction
None32 (56.1%)
Unknown24 (42.1%)
Required1 (1.8%)
Privileges Required
Low5 (8.8%)
High0 (0.0%)
None28 (49.1%)
Unknown24 (42.1%)
Top CVEs
Signals from CVEs in this product scope (57 CVEs).
57 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2012-6329HIGH The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly handle backslashes and fully qualified method names during compi | Jan 4, 2013 | 7.5 | 77 | NO | YES |
CVE-2026-13221CRITICAL Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_stud | Jul 13, 2026 | 9.1 | 41 | NO | NO |
CVE-2026-8376CRITICAL Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.
Perl_study_chunk in regcomp_study.c che | May 25, 2026 | 9.8 | 40 | NO | NO |
CVE-2018-18312CRITICAL Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations. | Dec 5, 2018 | 9.8 | 38 | NO | NO |
CVE-2026-57432HIGH Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.
S_measure_struct adds each item's size times i | Jul 13, 2026 | 8.4 | 37 | NO | NO |
CVE-2018-18311CRITICAL Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations. | Dec 7, 2018 | 9.8 | 37 | NO | NO |
CVE-2018-6913CRITICAL Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count. | Apr 17, 2018 | 9.8 | 36 | NO | NO |
CVE-2026-4176CRITICAL Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib.
Compress::Raw::Zlib is in | Mar 29, 2026 | 9.8 | 34 | NO | NO |
CVE-2018-18314CRITICAL Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations. | Dec 7, 2018 | 9.8 | 33 | NO | NO |
CVE-2018-18313CRITICAL Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory. | Dec 7, 2018 | 9.1 | 33 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (57 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
1 CVE
1.8% of CVEs· 96th percentile
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
6 CVEs
10.5% of CVEs· 89th percentile
Social Chatter
Signals from CVEs in this product scope (57 CVEs).
Media Mentions
Signals from CVEs in this product scope (57 CVEs).
Top CNAs Publishing CVEs For Perl
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 5.9.5 | 1 | 7.8 | 0.8% | 0 | 0 |
| 5.9.4 | 1 | 7.8 | 0.8% | 0 | 0 |
| 5.9.3 | 1 | 7.8 | 0.8% | 0 | 0 |
| 5.9.2 | 4 | 5.5 | 1.6% | 0 | 0 |
| 5.9.1 | 1 | 7.8 | 0.8% | 0 | 0 |
| 5.9.0 | 1 | 7.8 | 0.8% | 0 | 0 |
| 5.8.9 | 5 | 6.3 | 1.8% | 0 | 0 |
| 5.8.8 | 6 | 5.8 | 2.2% | 0 | 0 |
| 5.8.7 | 5 | 5.9 | 2.1% | 0 | 0 |
| 5.8.6 | 6 | 5.7 | 1.9% | 0 | 0 |
| 5.8.5 | 5 | 5.9 | 2.1% | 0 | 0 |
| 5.8.4 | 5 | 5.9 | 2.1% | 0 | 0 |
| 5.8.3 | 5 | 5.9 | 2.1% | 0 | 0 |
| 5.8.2 | 5 | 5.9 | 2.1% | 0 | 0 |
| 5.8.10 | 3 | 5.6 | 2.5% | 0 | 0 |
| 5.8.1 | 4 | 5.5 | 1.7% | 0 | 0 |
| 5.8.0 | 2 | 6.0 | 1.1% | 0 | 0 |
| 5.8 | 1 | 7.8 | 0.8% | 0 | 0 |
| 5.7.3 | 1 | 7.8 | 0.8% | 0 | 0 |
| 5.6.2 | 1 | 7.8 | 0.8% | 0 | 0 |