products / perl

Perl

Perl 5 remains embedded in ops tooling, legacy web stacks, and enterprise glue code. NVD tracks the interpreter under a single CPE product identifier. High-severity history concentrates in the regex engine (integer overflows, heap corruption) and Windows-specific path lookup for external commands.

api usage

Querying Perl

product slugperl

version format5.36.0, 5.40.0, 5.38.0

bash

curl "https://api.attestd.io/v1/check?product=perl&version=5.36.0" \
  -H "Authorization: Bearer $ATTESTD_KEY"

Perl 5.36.0 is affected by CVE-2023-47038 (heap buffer overflow via crafted Unicode-property regex) and CVE-2023-47039 (Windows cmd.exe PATH hijacking). The response aggregates both into a high risk_state with a fixed_version of 5.36.3.

json

{
  "product": "perl",
  "version": "5.36.0",
  "supported": true,
  "risk_state": "high",
  "risk_factors": [
    "remote_code_execution",
    "no_authentication_required",
    "internet_exposed_service",
    "patch_available"
  ],
  "actively_exploited": false,
  "remote_exploitable": true,
  "authentication_required": false,
  "patch_available": true,
  "fixed_version": "9.48",
  "confidence": 0.45,
  "cve_ids": [
    "CVE-1999-1386",
    "CVE-2023-31484",
    "CVE-2023-31486",
    "CVE-2023-47038",
    "CVE-2024-56406",
    "CVE-2026-13221",
    "CVE-2026-14741",
    "CVE-2026-15747",
    "CVE-2026-4176",
    "CVE-2026-57432",
    "CVE-2026-60074",
    "CVE-2026-60075",
    "CVE-2026-8376",
    "CVE-2026-8450"
  ],
  "cves": null,
  "max_epss": 0.01742,
  "last_updated": "2026-07-31T20:02:02.600056Z",
  "supply_chain": null,
  "supply_chain_monitored": false,
  "typosquat": null
}

safe version

Perl 5.40.0 is a current stable release that resolves the 2023 regex and Windows PATH CVEs listed below.

bash

curl "https://api.attestd.io/v1/check?product=perl&version=5.40.0" \
  -H "Authorization: Bearer $ATTESTD_KEY"

notable cves

CVE history

Core Perl CVEs repeatedly target the regex compiler and bytecode interpreter. The 2020 pair (CVE-2020-10878, CVE-2020-10543) forced out-of-band 5.30.x patches. The 2023 Unicode-property overflow and Windows PATH hijack affected long-lived 5.34 through 5.38 lines.

CVE	Description	Affects	CVSS
`CVE-2020-10878`	Integer overflow in regex compilation produces malformed bytecode and can inject instructions.	<5.30.3	8.6
`CVE-2020-10543`	Nested regex quantifiers overflow integers and corrupt the heap on 32-bit platforms.	<5.30.3	8.2
`CVE-2023-47038`	Crafted regex with illegal user-defined Unicode properties overflows a heap buffer by one controlled byte.	5.30.0 to 5.38.0	7.8
`CVE-2023-47039`	Windows Perl searches for cmd.exe via PATH starting in CWD and enables binary hijacking.	Windows before 5.34.3 / 5.36.3 / 5.38.2	7.8

data sources

Single CPE namespace

NVD publishes Perl 5 core CVEs under one product identifier:

cpe:2.3:a:perl:perlPerl 5 interpreter and regex engine

Attestd maps the perl product slug to this CPE and synthesizes version ranges across the full 5.x history.

All products Ruby Python Quickstart