CVE-2026-13221
Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.
- Perl
- ≤ 5.43.9
- Fix
- Available
- CVSS 3.1
- 9.1 CRITICAL
- EPSS
- 0.4% (36th percentile)
- Weakness
- CWE-190
- NVD status
- Analyzed
- Published
- 2026-07-13
Fix
Apply the upstream patch. The fix is included in the Perl 5.43.10 development release.
No indexed exploits for CVE-2026-13221 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-13221 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.