[<prev] [next>] [day] [month] [year] [list]
Message-ID: <cf8d729f-b6b2-4559-a815-138bd55e6e36@cpansec.org>
Date: Mon, 15 Jun 2026 22:12:33 +0100
From: Robert Rothenberg <rrwo@...nsec.org>
To: cve-announce@...urity.metacpan.org, oss-security@...ts.openwall.com
Subject: CVE-2026-12087: Socket versions before 2.041 for Perl have an
out-of-bounds heap read
========================================================================
CVE-2026-12087 CPAN Security Group
========================================================================
CVE ID: CVE-2026-12087
Distribution: Socket
Versions: before 2.041
MetaCPAN: https://metacpan.org/dist/Socket
Socket versions before 2.041 for Perl have an out-of-bounds heap read
Description
-----------
Socket versions before 2.041 for Perl have an out-of-bounds heap read.
In Socket.xs, pack_ip_mreq_source() checks the length of its source
argument before the argument is read, so the check tests the byte
length carried over from the preceding multiaddr argument instead. Both
addresses occupy a 4-byte field, so a valid multiaddr lets a source of
any length pass the check, and the source is then copied into the
4-byte imr_sourceaddr field with a fixed-size copy. A source shorter
than 4 bytes is not rejected, and the copy reads up to 3 bytes past the
end of its buffer.
Calling pack_ip_mreq_source() with a source value shorter than 4 bytes
copies adjacent heap memory into the returned packed structure.
Problem types
-------------
- CWE-125 Out-of-bounds Read
- CWE-805 Buffer Access with Incorrect Length Value
Solutions
---------
Upgrade to version 2.041 or later.
References
----------
https://metacpan.org/release/PEVANS/Socket-2.041/changes
https://github.com/Perl/perl5/commit/de19a0b0ad1900fef976c5c1400bd8f11ec6c6cb.patch
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
