CVE-2026-57433: 
NixOS vulnerability analysis and mitigation

CVE-2026-57433 is a signed integer overflow vulnerability in the Storable module for Perl affecting all versions before 3.41. The flaw exists in the deserialization logic for SX_HOOK records and can be triggered by passing a crafted serialized blob to the thaw or retrieve functions. It was disclosed on July 13, 2026, by the CPAN Security Group (CPANSec) via the oss-security mailing list and the GitHub Advisory Database. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, Openwall).

The root cause is an integer overflow or wraparound (CWE-190) in the retrieve_hook_common function within Storable.xs. This function reads a signed 32-bit item count (len3) from an SX_HOOK record and then calls av_extend(av, len3 + 1) to allocate an array. When len3 equals I32_MAX (2,147,483,647), adding one wraps the value to a large negative number due to signed integer overflow, causing av_extend to receive an invalid negative count and terminate with a panic. The fix, authored by Paul "LeoNerd" Evans, adds an explicit check: if len3 == I32_MAX, deserialization is aborted with an "Invalid count of hook data items" error before av_extend is called. No authentication or user interaction is required — any application that deserializes untrusted data using Storable's thaw or retrieve is exploitable over the network (Perl5 Commit, Openwall).

The primary confirmed impact is a Denial of Service (DoS): a crafted blob causes the Perl process performing deserialization to panic and terminate, disrupting any application relying on Storable for data exchange or persistence. The CVSS score of 9.8 reflects theoretical high confidentiality, integrity, and availability impacts, though the currently documented exploitation path results in application crash rather than code execution. Applications that process untrusted serialized Storable data — such as web services, caching layers, or IPC mechanisms — are at risk of being crashed by any unauthenticated network attacker who can supply input to the deserialization functions (GitHub Advisory, Openwall).

1. Identify target: Locate a Perl application that accepts externally supplied serialized data and processes it using Storable's thaw or retrieve functions (e.g., a web API endpoint, a caching service, or an IPC mechanism).
2. Craft malicious blob: Construct a Storable-format serialized blob containing an SX_HOOK record where the 32-bit signed item count field (len3) is set to I32_MAX (0x7FFFFFFF).
3. Submit the payload: Deliver the crafted blob to the target application via the relevant input channel (e.g., HTTP request body, message queue, shared memory, or file upload).
4. Trigger the overflow: When the application calls thaw or retrieve on the blob, retrieve_hook_common reads the I32_MAX count and computes len3 + 1, which wraps to a negative value, causing av_extend to panic.
5. Achieve DoS: The Perl interpreter terminates with a panic, crashing the application or worker process and causing a denial of service (Openwall, Perl5 Commit).

• Logs: Perl application logs showing unexpected panic messages such as panic: av_extend or Invalid count of hook data items originating from Storable deserialization code.
• Process: Sudden termination or crash of Perl worker processes handling deserialization tasks; repeated process restarts by a supervisor (e.g., systemd, Starman, Plack) without a clear application-level error.
• Network: Unusual or malformed binary blobs submitted to application endpoints that accept serialized Perl data; repeated requests to the same endpoint resulting in process crashes.
• Application: Error logs referencing Storable.xs, retrieve_hook_common, or SX_HOOK in stack traces.

Upgrade Storable to version 3.41 or later, which includes the fix that explicitly rejects SX_HOOK records with an item count of I32_MAX (Perl5 Commit, Openwall). Storable is distributed as part of the Perl core, so upgrading Perl itself or the standalone CPAN distribution (cpan install Storable) will apply the fix. As an interim workaround, restrict the use of thaw and retrieve to trusted, internally generated data sources only, and avoid deserializing any user-supplied or externally sourced serialized blobs.

The vulnerability was disclosed by Stig Palmquist on behalf of the CPAN Security Group (CPANSec) via the oss-security mailing list on July 13, 2026 (Openwall). The fix was authored by Paul "LeoNerd" Evans and merged into the Perl 5 repository. The issue was noted in the Perl perldelta release notes (MetaCPAN) and received standard coverage from vulnerability tracking services. No significant broader community controversy or threat actor commentary has been observed.