CVE-2026-13221: 
NixOS vulnerability analysis and mitigation

CVE-2026-13221 is an integer overflow vulnerability in Perl's regular expression engine that causes silently incorrect regex matches when an alternation of more than 65,535 fixed string branches is compiled into a trie in Perl_study_chunk. All Perl versions through 5.43.9 are affected; the fix is included in Perl 5.43.10. The vulnerability was disclosed on July 13, 2026, by the CPAN Security Group (CPANSec) and assigned a CVSS v3.1 base score of 9.1 (Critical) (Github Advisory, Openwall OSS-Sec).

The root cause is CWE-190 (Integer Overflow or Wraparound) in regcomp_study.c within Perl_study_chunk. When more than 65,535 fixed-string alternation branches are compiled into a trie, the delta between the first branch and the shared tail node is stored in a 16-bit field (U16); a branch count exceeding 65,535 overflows this field, truncating the trie's match decision table silently with no warning or error. The bug was introduced by commit acababb and is reproducible in Perl 5.38.2 through 5.42.x; Perl 5.36.0 is not affected. The fix (commit 03f74bbbd3a68350d926ee93d56ee4808c28c4c7) prevents trie optimization when the offset would overflow U16_MAX, effectively skipping the problematic optimization path (Perl5 GitHub Issue, Perl5 Patch).

Exploitation causes the Perl regex engine to produce false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a regex pattern is used to gate access control, input validation, or security filtering decisions, the incorrect match results can allow unauthorized access or cause legitimate inputs to be incorrectly rejected. The CVSS assessment reflects high integrity and high availability impact with no confidentiality impact, as attackers can bypass filters or disrupt application logic but cannot directly read sensitive data (Github Advisory, Openwall OSS-Sec).

1. Identify target application: Locate a Perl application (version ≤ 5.43.9) that uses a large regex alternation pattern (>65,535 fixed string branches) for access control, input filtering, or authentication decisions.
2. Craft a triggering input: Construct an input string that should be rejected by the regex filter but, due to the trie overflow, produces a false positive match — or conversely, a string that should match but produces a false negative.
3. Submit the crafted input: Send the crafted input to the application endpoint that evaluates the vulnerable regex (e.g., via HTTP request, form submission, or API call).
4. Bypass security control: The overflowed trie causes the regex engine to return an incorrect match result, allowing the attacker to bypass the filter, gain unauthorized access, or cause the application to accept/reject data incorrectly.
5. Leverage access: Use the bypassed control to access restricted resources, inject malicious data, or disrupt application logic depending on the application's use of the regex (Perl5 GitHub Issue, Openwall OSS-Sec).

The fix is included in Perl 5.43.10 (development release); users should upgrade to this version or any subsequent stable release that incorporates commit 03f74bbbd3a68350d926ee93d56ee4808c28c4c7. As a workaround, developers should audit Perl applications for regex patterns using large alternations (>65,535 branches) and refactor them to avoid triggering the vulnerable trie optimization path. Red Hat has issued an errata (RHSA-2026:39997) for affected distributions (Openwall OSS-Sec, Perl5 Patch).

The vulnerability was disclosed by Stig Palmquist on behalf of the CPAN Security Group via the oss-security mailing list on July 13, 2026 (Openwall OSS-Sec). The Perl 5.44 release, which includes the fix, received coverage from technology outlets such as Heise and Linuxiac highlighting the new named function parameters feature alongside the security fix. The Perl community discussed the issue on the perl5-porters mailing list, and the fix was noted in the official perldelta changelog (Perl perldelta).