[<prev] [next>] [day] [month] [year] [list]
Message-ID: <ahyQUB4ccRjl5ZAI@pjcj.com>
Date: Sun, 31 May 2026 21:50:01 +0200
From: Paul Johnson <paul@...j.net>
To: cve-announce@...urity.metacpan.org, oss-security@...ts.openwall.com
Subject: CVE-2026-8796: Sereal::Decoder versions before 5.005 for Perl allow
heap out-of-bounds read via crafted input
========================================================================
CVE-2026-8796 CPAN Security Group
========================================================================
CVE ID: CVE-2026-8796
Distribution: Sereal-Decoder
Versions: before 5.005
MetaCPAN: https://metacpan.org/dist/Sereal-Decoder
VCS Repo: https://github.com/Sereal/Sereal
Sereal::Decoder versions before 5.005 for Perl allow heap out-of-bounds
read via crafted input
Description
-----------
Sereal::Decoder versions before 5.005 for Perl allow heap out-of-bounds
read via crafted input.
In Perl/Decoder/srl_decoder.c, srl_read_object() and srl_read_hash()
process a COPY tag, a back-reference whose target byte the decoder
re-decodes as a fresh tag. When that target byte matches the
SHORT_BINARY pattern (an inline string whose length is encoded in the
low bits of the tag), the resulting read is not bounded to precede the
COPY tag's own offset and can run past the end of the input buffer. An
attacker controlled COPY offset can land inside a previously decoded
value rather than on a tag boundary, planting a byte that the decoder
reads as a SHORT_BINARY tag and consuming up to 31 following bytes from
the heap as a class name (OBJECT path) or hash key (HASH path).
Problem types
-------------
- CWE-125 Out-of-bounds Read
Solutions
---------
Upgrade to Sereal::Decoder 5.005 or later.
References
----------
https://github.com/Sereal/Sereal/commit/303a2c69cdba80bf37a3ff43461e0aa78198a7a3.patch
https://metacpan.org/release/YVES/Sereal-Decoder-5.005/changes
Timeline
--------
- 2026-05-13: Issue reported.
- 2026-05-19: Fix released in Sereal::Decoder 5.005.
- 2026-05-20: Fix verified against proofs of concept.
--
Paul Johnson - paul@...j.net
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
