https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 06:31:37 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-323557 EUVD-2026-323557 https://cve.radiocsirt.org/vuln/euvd-2026-323557 https://cve.radiocsirt.org/vuln/fkie_cve-2026-8796 <p>Sereal::Decoder versions before 5.005 for Perl allow heap out-of-bounds read via crafted input.</p> <p>In Perl/Decoder/srl_decoder.c, srl_read_object() and srl_read_hash() process a COPY tag, a back-reference whose target byte the decoder re-decodes as a fresh tag. When that target byte matches the SHORT_BINARY pattern (an inline string whose length is encoded in the low bits of the tag), the resulting read is not bounded to precede the COPY tag&#39;s own offset and can run past the end of the input buffer. An attacker controlled COPY offset can land inside a previously decoded value rather than on a tag boundary, planting a byte that the decoder reads as a SHORT_BINARY tag and consuming up to 31 following bytes from the heap as a class name (OBJECT path) or hash key (HASH path).</p> <p>Sereal::Decoder versions before 5.005 for Perl allow heap out-of-bounds read via crafted input.</p> <p>In Perl/Decoder/srl_decoder.c, srl_read_object() and srl_read_hash() process a COPY tag, a back-reference whose target byte the decoder re-decodes as a fresh tag. When that target byte matches the SHORT_BINARY pattern (an inline string whose length is encoded in the low bits of the tag), the resulting read is not bounded to precede the COPY tag&#39;s own offset and can run past the end of the input buffer. An attacker controlled COPY offset can land inside a previously decoded value rather than on a tag boundary, planting a byte that the decoder reads as a SHORT_BINARY tag and consuming up to 31 following bytes from the heap as a class name (OBJECT path) or hash key (HASH path).</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-8796 https://cve.radiocsirt.org/vuln/ghsa-xhpj-269v-vq2q <p>Sereal::Decoder versions before 5.005 for Perl allow heap out-of-bounds read via crafted input.</p> <p>In Perl/Decoder/srl_decoder.c, srl_read_object() and srl_read_hash() process a COPY tag, a back-reference whose target byte the decoder re-decodes as a fresh tag. When that target byte matches the SHORT_BINARY pattern (an inline string whose length is encoded in the low bits of the tag), the resulting read is not bounded to precede the COPY tag&#39;s own offset and can run past the end of the input buffer. An attacker controlled COPY offset can land inside a previously decoded value rather than on a tag boundary, planting a byte that the decoder reads as a SHORT_BINARY tag and consuming up to 31 following bytes from the heap as a class name (OBJECT path) or hash key (HASH path).</p> <p>Sereal::Decoder versions before 5.005 for Perl allow heap out-of-bounds read via crafted input.</p> <p>In Perl/Decoder/srl_decoder.c, srl_read_object() and srl_read_hash() process a COPY tag, a back-reference whose target byte the decoder re-decodes as a fresh tag. When that target byte matches the SHORT_BINARY pattern (an inline string whose length is encoded in the low bits of the tag), the resulting read is not bounded to precede the COPY tag&#39;s own offset and can run past the end of the input buffer. An attacker controlled COPY offset can land inside a previously decoded value rather than on a tag boundary, planting a byte that the decoder reads as a SHORT_BINARY tag and consuming up to 31 following bytes from the heap as a class name (OBJECT path) or hash key (HASH path).</p> https://cve.radiocsirt.org/vuln/ghsa-xhpj-269v-vq2q https://cve.radiocsirt.org/vuln/opensuse-su-2026:10924-1 <p>perl-Sereal-Decoder-5.6.0-1.1 on GA media</p> <p>perl-Sereal-Decoder-5.6.0-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10924-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-8796 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: libsereal-decoder-perl, Ubuntu:18.04:LTS: libsereal-decoder-perl, Ubuntu:20.04:LTS: libsereal-decoder-perl, Ubuntu:22.04:LTS: libsereal-decoder-perl, Ubuntu:24.04:LTS: libsereal-decoder-perl, Ubuntu:25.10: libsereal-decoder-perl, Ubuntu:26.04:LTS: libsereal-decoder-perl</p> <p>Sereal::Decoder versions before 5.005 for Perl allow heap out-of-bounds read via crafted input. In Perl/Decoder/srl_decoder.c, srl_read_object() and srl_read_hash() process a COPY tag, a back-reference whose target byte the decoder re-decodes as a fresh tag. When that target byte matches the SHORT_BINARY pattern (an inline string whose length is encoded in the low bits of the tag), the resulting read is not bounded to precede the COPY tag&#39;s own offset and can run past the end of the input buffer. An attacker controlled COPY offset can land inside a previously decoded value rather than on a tag boundary, planting a byte that the decoder reads as a SHORT_BINARY tag and consuming up to 31 following bytes from the heap as a class name (OBJECT path) or hash key (HASH path).</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: libsereal-decoder-perl, Ubuntu:18.04:LTS: libsereal-decoder-perl, Ubuntu:20.04:LTS: libsereal-decoder-perl, Ubuntu:22.04:LTS: libsereal-decoder-perl, Ubuntu:24.04:LTS: libsereal-decoder-perl, Ubuntu:25.10: libsereal-decoder-perl, Ubuntu:26.04:LTS: libsereal-decoder-perl</p> <p>Sereal::Decoder versions before 5.005 for Perl allow heap out-of-bounds read via crafted input. In Perl/Decoder/srl_decoder.c, srl_read_object() and srl_read_hash() process a COPY tag, a back-reference whose target byte the decoder re-decodes as a fresh tag. When that target byte matches the SHORT_BINARY pattern (an inline string whose length is encoded in the low bits of the tag), the resulting read is not bounded to precede the COPY tag&#39;s own offset and can run past the end of the input buffer. An attacker controlled COPY offset can land inside a previously decoded value rather than on a tag boundary, planting a byte that the decoder reads as a SHORT_BINARY tag and consuming up to 31 following bytes from the heap as a class name (OBJECT path) or hash key (HASH path).</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-8796