{"id":"CVE-2018-18311","title":"Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.","published":"2018-12-07T17:29:00.407Z","updated":"2026-06-16T21:46:58.077Z","severity":"critical","cvssScore":9.8,"epss":0.11676,"epssPct":0.96116,"kev":false,"maturity":"none","actionScore":43,"primaryVendor":"perl","primaryProduct":"perl","cweId":"CWE-190","fixAvailable":true,"tags":["pre-auth","memory","remote","no-ui"],"epssDelta7":0,"summary":"Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.","cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssVersion":"3.0","cvssSource":"nvd-primary","cweName":"Integer Overflow or Wraparound","kevAdded":null,"kevDue":null,"kevRansomware":null,"source":"nvd","cna":"mitre","ssvc":null,"sources":{"cna":"2024-08-05T11:08:21.612Z","osv":"2026-11-13T03:18:18.039Z","epss":"2026-11-12","cna_seen":"2026-09-29T10:51:50.081Z"},"cvssCna":null,"hasPatchRef":true,"credits":[],"counts":{"exploitdb":0,"metasploit":0,"nuclei":0,"githubPoc":0},"products":[{"vendor":"perl","product":"perl","cpe":"cpe:2.3:a:perl:perl"},{"vendor":"canonical","product":"ubuntu linux","cpe":"cpe:2.3:o:canonical:ubuntu_linux"},{"vendor":"debian","product":"debian linux","cpe":"cpe:2.3:o:debian:debian_linux"},{"vendor":"netapp","product":"e-series santricity os controller","cpe":"cpe:2.3:a:netapp:e-series_santricity_os_controller"},{"vendor":"netapp","product":"snap creator framework","cpe":"cpe:2.3:a:netapp:snap_creator_framework"},{"vendor":"netapp","product":"snapcenter","cpe":"cpe:2.3:a:netapp:snapcenter"},{"vendor":"netapp","product":"snapdriver","cpe":"cpe:2.3:a:netapp:snapdriver"},{"vendor":"redhat","product":"openshift container platform","cpe":"cpe:2.3:a:redhat:openshift_container_platform"},{"vendor":"redhat","product":"enterprise linux","cpe":"cpe:2.3:o:redhat:enterprise_linux"},{"vendor":"redhat","product":"enterprise linux desktop","cpe":"cpe:2.3:o:redhat:enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise linux eus","cpe":"cpe:2.3:o:redhat:enterprise_linux_eus"},{"vendor":"redhat","product":"enterprise linux server","cpe":"cpe:2.3:o:redhat:enterprise_linux_server"},{"vendor":"redhat","product":"enterprise linux server aus","cpe":"cpe:2.3:o:redhat:enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise linux server tus","cpe":"cpe:2.3:o:redhat:enterprise_linux_server_tus"},{"vendor":"redhat","product":"enterprise linux workstation","cpe":"cpe:2.3:o:redhat:enterprise_linux_workstation"},{"vendor":"apple","product":"mac os x","cpe":"cpe:2.3:o:apple:mac_os_x"},{"vendor":"fedoraproject","product":"fedora","cpe":"cpe:2.3:o:fedoraproject:fedora"},{"vendor":"mcafee","product":"web gateway","cpe":"cpe:2.3:a:mcafee:web_gateway"}],"references":[{"url":"http://seclists.org/fulldisclosure/2019/Mar/49","tags":"Mailing List,Third Party Advisory"},{"url":"http://www.securityfocus.com/bid/106145","tags":"Third Party Advisory,VDB Entry"},{"url":"http://www.securitytracker.com/id/1042181","tags":"Third Party Advisory,VDB Entry"},{"url":"https://access.redhat.com/errata/RHBA-2019:0327","tags":"Third Party Advisory"},{"url":"https://access.redhat.com/errata/RHSA-2019:0001","tags":"Third Party Advisory"},{"url":"https://access.redhat.com/errata/RHSA-2019:0010","tags":"Third Party Advisory"},{"url":"https://access.redhat.com/errata/RHSA-2019:0109","tags":"Third Party Advisory"},{"url":"https://access.redhat.com/errata/RHSA-2019:1790","tags":null},{"url":"https://access.redhat.com/errata/RHSA-2019:1942","tags":null},{"url":"https://access.redhat.com/errata/RHSA-2019:2400","tags":null},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1646730","tags":"Issue Tracking,Patch,Third Party Advisory"},{"url":"https://github.com/Perl/perl5/commit/34716e2a6ee2af96078d62b065b7785c001194be","tags":"Patch,Third Party Advisory"},{"url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10278","tags":"Third Party Advisory"},{"url":"https://lists.debian.org/debian-lts-announce/2018/11/msg00039.html","tags":"Mailing List,Third Party Advisory"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWQGEB543QN7SSBRKYJM6PSOC3RLYGSM/","tags":null},{"url":"https://metacpan.org/changes/release/SHAY/perl-5.26.3","tags":"Third Party Advisory"},{"url":"https://metacpan.org/changes/release/SHAY/perl-5.28.1","tags":"Third Party Advisory"},{"url":"https://rt.perl.org/Ticket/Display.html?id=133204","tags":"Issue Tracking,Third Party Advisory"},{"url":"https://seclists.org/bugtraq/2019/Mar/42","tags":"Mailing List,Third Party Advisory"},{"url":"https://security.gentoo.org/glsa/201909-01","tags":null},{"url":"https://security.netapp.com/advisory/ntap-20190221-0003/","tags":"Third Party Advisory"},{"url":"https://support.apple.com/kb/HT209600","tags":"Third Party Advisory"},{"url":"https://usn.ubuntu.com/3834-1/","tags":"Third Party Advisory"},{"url":"https://usn.ubuntu.com/3834-2/","tags":"Third Party Advisory"},{"url":"https://www.debian.org/security/2018/dsa-4347","tags":"Third Party Advisory"},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":null},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","tags":null},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":null}],"exploits":[],"analysis":null,"affectedVersions":[{"vendor":"apple","product":"mac os x","version":"*","vsi":null,"vse":null,"vei":null,"vee":"10.14.4"},{"vendor":"canonical","product":"ubuntu linux","version":"12.04","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"canonical","product":"ubuntu linux","version":"14.04","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"canonical","product":"ubuntu linux","version":"16.04","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"canonical","product":"ubuntu linux","version":"18.04","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"canonical","product":"ubuntu linux","version":"18.10","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"debian","product":"debian linux","version":"8.0","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"debian","product":"debian linux","version":"9.0","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"fedoraproject","product":"fedora","version":"29","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"mcafee","product":"web gateway","version":"*","vsi":"7.7.2","vse":null,"vei":null,"vee":"7.7.2.21"},{"vendor":"mcafee","product":"web gateway","version":"*","vsi":"8.0.0","vse":null,"vei":null,"vee":"8.1.1"},{"vendor":"mcafee","product":"web gateway","version":"*","vsi":"7.8.2","vse":null,"vei":null,"vee":"7.8.2.8"},{"vendor":"netapp","product":"e-series santricity os controller","version":"*","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"netapp","product":"snap creator framework","version":"*","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"netapp","product":"snapcenter","version":"*","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"netapp","product":"snapdriver","version":"*","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"perl","product":"perl","version":"*","vsi":null,"vse":null,"vei":null,"vee":"5.26.3"},{"vendor":"perl","product":"perl","version":"*","vsi":"5.28.0","vse":null,"vei":null,"vee":"5.28.1"},{"vendor":"redhat","product":"enterprise linux","version":"6.0","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"redhat","product":"enterprise linux","version":"7.0","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"redhat","product":"enterprise linux","version":"7.4","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"redhat","product":"enterprise linux","version":"7.5","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"redhat","product":"enterprise linux","version":"7.6","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"redhat","product":"enterprise linux desktop","version":"7.0","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"redhat","product":"enterprise linux eus","version":"7.6","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"redhat","product":"enterprise linux server","version":"7.0","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"redhat","product":"enterprise linux server aus","version":"7.6","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"redhat","product":"enterprise linux server tus","version":"7.6","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"redhat","product":"enterprise linux workstation","version":"7.0","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"redhat","product":"openshift container platform","version":"3.11","vsi":null,"vse":null,"vei":null,"vee":null}],"source_attribution":"NVD (NIST), CVE Program, CISA KEV, FIRST EPSS, OSV. Aggregated by Noroxi."}