CVE-2026-13221: 
NixOS vulnerability analysis and mitigation

CVE-2026-13221 is an integer overflow vulnerability in Perl's regular expression engine that causes silently incorrect regex matches when an alternation of more than 65,535 fixed string branches is compiled into a trie in Perl_study_chunk. Affected versions include all Perl releases through 5.43.9; the fix was introduced in Perl 5.43.10. The issue was originally reported as a bug (GH #23388) on June 27, 2025, and publicly disclosed as a CVE on July 13, 2026 by the CPAN Security Group. It carries a CVSS v3.1 base score of 9.1 (Critical) (Github Advisory, Openwall OSS-Sec).

The root cause is CWE-190 (Integer Overflow or Wraparound): when Perl's regex compiler (regcomp_study.c) combines more than 65,535 fixed-string alternation branches into a trie, the delta between the first branch and the shared tail node is stored in a 16-bit field. A branch count exceeding 65,535 overflows this field, truncating the trie's match decision table silently — no warning or error is emitted. The result is that the compiled pattern produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). The vulnerability is exploitable remotely with no authentication or user interaction required, provided an attacker can supply input to a Perl application that uses such a large alternation regex for access control or filtering decisions. The fix (commit 03f74bbbd) adds a guard in regcomp_study.c to skip trie optimization when the branch-to-tail delta would exceed U16_MAX (Perl5 Commit Patch, Perl5 Issue #23388).

Successful exploitation allows an unauthenticated network attacker to bypass security filters or access controls implemented in Perl applications that rely on large alternation regex patterns for allow/deny decisions. The integrity impact is high — an attacker can cause the regex to accept inputs it should reject (false positives), enabling unauthorized access, or reject inputs it should accept (false negatives), causing denial of service for legitimate users. Confidentiality is not directly impacted, but integrity and availability are both rated High. Applications using such patterns as blocklists, allowlists, or input validators are at greatest risk (Github Advisory, Openwall OSS-Sec).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Github Advisory). The EPSS score is approximately 0.207% (per Feedly) to 0.432% (per GitHub Advisory), placing it in the 35th percentile for exploitation likelihood within 30 days. The vulnerability is classified as automatable (no user interaction required) with network attack vector and low complexity, but exploitation requires the target application to use a regex with more than 65,535 alternation branches — a relatively uncommon pattern in practice. No threat actor attribution or CISA KEV catalog listing has been identified (Github Advisory).

1. Reconnaissance: Identify Perl-based web applications or services that use large alternation regex patterns (e.g., blocklists, allowlists, or input validators with thousands of fixed string branches) for access control or filtering decisions, targeting versions through Perl 5.43.9.
2. Understand the trigger condition: Confirm the target application constructs or uses a regex with more than 65,535 fixed-string alternation branches compiled into a trie (e.g., m/(?:aaa|aab|...|mzz)|(?:naa|...|zzz)/).
3. Craft bypass input: Identify a string that should be rejected by the filter (e.g., a blocked value) but, due to the trie overflow, is incorrectly matched as a false negative — meaning the regex fails to match it and the filter passes it through.
4. Submit crafted input: Send the crafted input to the vulnerable application endpoint. The overflowed trie causes the regex engine to silently produce an incorrect result, bypassing the intended security control.
5. Achieve objective: Depending on the application's logic, the attacker may gain unauthorized access, bypass an IP/string blocklist, inject disallowed content, or cause the application to reject legitimate traffic (denial of service) (Perl5 Issue #23388, Openwall OSS-Sec).

• Logs: Application logs showing unexpected access grants or filter bypasses for inputs that should have been blocked; anomalous patterns in access logs where known-bad strings pass validation checks.
• Application Behavior: Perl applications silently accepting or rejecting inputs inconsistently when large alternation regex patterns are involved; no error or warning messages from the Perl runtime despite incorrect matching behavior.
• Process/Runtime: Perl processes handling regex compilation of patterns with thousands of alternation branches (detectable via debug output with use re 'Debug'); the original bug report noted crashes with use re 'Debug' enabled on affected versions (Perl5 Issue #23388).

The fix is included in Perl 5.43.10 (development release), which adds a guard in regcomp_study.c to skip trie optimization when the branch-to-tail delta would overflow a 16-bit field. Organizations should upgrade to Perl 5.43.10 or later, or apply the upstream patch (commit 03f74bbbd3a68350d926ee93d56ee4808c28c4c7) directly. As a workaround, developers should audit Perl applications for regex patterns with more than 65,535 alternation branches used in security-sensitive contexts and refactor them to avoid this pattern (e.g., split into multiple smaller regexes or use hash-based lookups instead). Red Hat has issued an errata (RHSA-2026:39997) for affected distributions (Openwall OSS-Sec, Perl5 Commit Patch).

The vulnerability was disclosed by Stig Palmquist on behalf of the CPAN Security Group via the oss-security mailing list on July 13, 2026, with a clear technical description and patch reference (Openwall OSS-Sec). Microsoft acknowledged the CVE through its Security Response Center advisory (Microsoft MSRC). Community discussion on the Perl5 Porters mailing list addressed the fix and its implications for the 5.44 release cycle. Coverage also appeared in general Linux and Perl community outlets noting the Perl 5.44 release that incorporated the fix (Heise).