CVE Explorer
CVE-2026-8796
Sereal::Decoder versions before 5.005 for Perl allow heap out-of-bounds read via crafted input.
In Perl/Decoder/srl_decoder.c, srl_read_object() and srl_read_hash() process a COPY tag, a back-reference whose target byte the decoder re-decodes as a fresh tag. When that target byte matches the SHORT_BINARY pattern (an inline string whose length is encoded in the low bits of the tag), the resulting read is not bounded to precede the COPY tag's own offset and can run past the end of the input buffe
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"collectionURL":"https://cpan.org/modules","defaultStatus":"unaffected","packageName":"Sereal-Decoder","product":"Sereal::Decoder","programFiles":["Perl/Decoder/srl_decoder.c"],"programRoutines":[{"name":"srl_read_object()"},{"name":"srl_read_hash()"}],"repo":"https://github.com/Sereal/Sereal","vendor":"YVES","versions":[{"lessThan":"5.005","status":"affected","version":"0","versionType":"custom"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:e07090b2e4b4911867e04e2c4672f7791f4bc1ce8a2f0150817770807d291a67 · sha256:cd36828c225b3535… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:e07090b2e4b4911867e04e2c4672f7791f4bc1ce8a2f0150817770807d291a67 · sha256:cd36828c225b3535… · /containers/adp/1/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-125","description":"CWE-125 Out-of-bounds Read","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:e07090b2e4b4911867e04e2c4672f7791f4bc1ce8a2f0150817770807d291a67 · sha256:cd36828c225b3535… · /containers/cna/problemTypes/0/descriptions/0
Source references
3 source assertions{"url":"http://www.openwall.com/lists/oss-security/2026/06/01/1"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:e07090b2e4b4911867e04e2c4672f7791f4bc1ce8a2f0150817770807d291a67 · sha256:cd36828c225b3535… · /containers/adp/0/references/0
{"tags":["patch"],"url":"https://github.com/Sereal/Sereal/commit/303a2c69cdba80bf37a3ff43461e0aa78198a7a3.patch"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:e07090b2e4b4911867e04e2c4672f7791f4bc1ce8a2f0150817770807d291a67 · sha256:cd36828c225b3535… · /containers/cna/references/0
{"tags":["release-notes"],"url":"https://metacpan.org/release/YVES/Sereal-Decoder-5.005/changes"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:e07090b2e4b4911867e04e2c4672f7791f4bc1ce8a2f0150817770807d291a67 · sha256:cd36828c225b3535… · /containers/cna/references/1
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.