{"id":"CVE-2018-18312","title":"Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.","published":"2018-12-05T18:29:00.303Z","updated":"2026-06-16T21:46:58.317Z","severity":"critical","cvssScore":9.8,"epss":0.12768,"epssPct":0.96331,"kev":false,"maturity":"none","actionScore":43,"primaryVendor":"perl","primaryProduct":"perl","cweId":"CWE-119","fixAvailable":true,"tags":["pre-auth","memory","remote","no-ui"],"epssDelta7":0.0068,"summary":"Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.","cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssVersion":"3.0","cvssSource":"nvd-primary","cweName":"Improper Restriction of Operations within the Bounds of a Memory Buffer","kevAdded":null,"kevDue":null,"kevRansomware":null,"source":"nvd","cna":"mitre","ssvc":null,"sources":{"cna":"2024-08-05T11:08:21.746Z","osv":"2026-11-13T03:18:18.039Z","epss":"2026-11-12","cna_seen":"2026-09-29T10:51:50.082Z"},"cvssCna":null,"hasPatchRef":false,"credits":[],"counts":{"exploitdb":0,"metasploit":0,"nuclei":0,"githubPoc":0},"products":[{"vendor":"perl","product":"perl","cpe":"cpe:2.3:a:perl:perl"},{"vendor":"canonical","product":"ubuntu linux","cpe":"cpe:2.3:o:canonical:ubuntu_linux"},{"vendor":"debian","product":"debian linux","cpe":"cpe:2.3:o:debian:debian_linux"},{"vendor":"redhat","product":"enterprise linux","cpe":"cpe:2.3:o:redhat:enterprise_linux"},{"vendor":"netapp","product":"e-series santricity os controller","cpe":"cpe:2.3:a:netapp:e-series_santricity_os_controller"},{"vendor":"netapp","product":"snap creator framework","cpe":"cpe:2.3:a:netapp:snap_creator_framework"},{"vendor":"netapp","product":"snapcenter","cpe":"cpe:2.3:a:netapp:snapcenter"},{"vendor":"netapp","product":"snapdrive","cpe":"cpe:2.3:a:netapp:snapdrive"}],"references":[{"url":"http://www.securityfocus.com/bid/106179","tags":"Third Party Advisory,VDB Entry"},{"url":"http://www.securitytracker.com/id/1042181","tags":"Third Party Advisory,VDB Entry"},{"url":"https://access.redhat.com/errata/RHSA-2019:0001","tags":"Third Party Advisory"},{"url":"https://access.redhat.com/errata/RHSA-2019:0010","tags":"Third Party Advisory"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1646734","tags":"Issue Tracking,Third Party Advisory"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWQGEB543QN7SSBRKYJM6PSOC3RLYGSM/","tags":null},{"url":"https://metacpan.org/changes/release/SHAY/perl-5.26.3","tags":"Third Party Advisory"},{"url":"https://metacpan.org/changes/release/SHAY/perl-5.28.1","tags":"Third Party Advisory"},{"url":"https://security.gentoo.org/glsa/201909-01","tags":null},{"url":"https://security.netapp.com/advisory/ntap-20190221-0003/","tags":"Third Party Advisory"},{"url":"https://usn.ubuntu.com/3834-1/","tags":"Third Party Advisory"},{"url":"https://www.debian.org/security/2018/dsa-4347","tags":"Third Party Advisory"},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","tags":null}],"exploits":[],"analysis":null,"affectedVersions":[{"vendor":"canonical","product":"ubuntu linux","version":"14.04","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"canonical","product":"ubuntu linux","version":"16.04","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"canonical","product":"ubuntu linux","version":"18.04","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"canonical","product":"ubuntu linux","version":"18.10","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"debian","product":"debian linux","version":"9.0","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"netapp","product":"e-series santricity os controller","version":"*","vsi":"11.0","vse":null,"vei":"11.40","vee":null},{"vendor":"netapp","product":"snap creator framework","version":"*","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"netapp","product":"snapcenter","version":"*","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"netapp","product":"snapdrive","version":"*","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"perl","product":"perl","version":"*","vsi":null,"vse":null,"vei":null,"vee":"5.26.3"},{"vendor":"perl","product":"perl","version":"*","vsi":"5.28.0","vse":null,"vei":null,"vee":"5.28.1"},{"vendor":"redhat","product":"enterprise linux","version":"6.0","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"redhat","product":"enterprise linux","version":"7.0","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"redhat","product":"enterprise linux","version":"7.4","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"redhat","product":"enterprise linux","version":"7.5","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"redhat","product":"enterprise linux","version":"7.6","vsi":null,"vse":null,"vei":null,"vee":null}],"source_attribution":"NVD (NIST), CVE Program, CISA KEV, FIRST EPSS, OSV. Aggregated by Noroxi."}