CVE-2024-56406
published 2025-04-13CVE-2024-56406: A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from…
PriorityP343high8.4CVSS 3.1
AVLACLPRNUINSUCHIHAH
EPSS
0.54%
41.9th percentile
A heap buffer overflow vulnerability was discovered in Perl.
Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10.
When there are non-ASCII bytes in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`.
$ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;'
Segmentation fault (core dumped)
It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | perl | < perl 5.36.0-7+deb12u2 (bookworm) | perl 5.36.0-7+deb12u2 (bookworm) |
| msrc | azl3_perl_5.38.2-507_on_azure_linux_3.0 | — | — |
| msrc | azl3_perl_5.38.2-508_on_azure_linux_3.0 | — | — |
| msrc | cbl2_perl_5.34.1-490_on_cbl_mariner_2.0 | — | — |
| perl | perl | >= 0 < 5.36.2-r1 | 5.36.2-r1 |
| perl | perl | >= 0 < 5.38.3-r1 | 5.38.3-r1 |
| perl | perl | >= 0 < 5.38.3-r1 | 5.38.3-r1 |
| perl | perl | >= 0 < 5.40.1-r1 | 5.40.1-r1 |
| perl | perl | >= 0 < 5.40.1-r1 | 5.40.1-r1 |
| perl | perl | >= 0 < 5.40.1-r1 | 5.40.1-r1 |
| perl | perl | >= 0 < 5.36.0-7+deb12u2 | 5.36.0-7+deb12u2 |
| perl | perl | >= 0 < 5.40.1-3 | 5.40.1-3 |
| perl | perl | >= 0 < 5.40.1-3 | 5.40.1-3 |
| perl | perl | >= 5.33.1 < 5.38.4-RC1 | 5.38.4-RC1 |
| perl | perl | >= 5.33.1 < 5.38.4 | 5.38.4 |
| perl | perl | >= 5.39.0 < 5.40.2-RC1 | 5.40.2-RC1 |
| perl | perl | >= 5.39.0 < 5.40.2 | 5.40.2 |
| perl | perl | 5.41.0 – 5.41.10 | — |
CVSS provenance
nvdv3.18.4HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv8.4HIGH
vendor_msrc8.6HIGH
vendor_oracle8.6HIGH
vendor_debian8.4HIGH
vendor_redhat8.4HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Third Party (Perl) — CVE-2024-56406
vendor_oracle·2026-01-15·CVSS 8.6
CVE-2024-56406 [HIGH] Oracle Oracle Fusion Middleware Risk Matrix: Third Party (Perl) — CVE-2024-56406
Oracle Oracle Fusion Middleware Risk Matrix: Third Party (Perl) vulnerability
CVE: CVE-2024-56406
CVSS: 8.6
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2026 (JAN 2026)
Oracle
Oracle Oracle Communications Applications Risk Matrix: SE_VFG_Security_Feature (Perl) — CVE-2024-56406
vendor_oracle·2025-07-15·CVSS 8.6
CVE-2024-56406 [HIGH] Oracle Oracle Communications Applications Risk Matrix: SE_VFG_Security_Feature (Perl) — CVE-2024-56406
Oracle Oracle Communications Applications Risk Matrix: SE_VFG_Security_Feature (Perl) vulnerability
CVE: CVE-2024-56406
CVSS: 8.6
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2025 (JUL 2025)
Ubuntu
Perl vulnerability
vendor_ubuntu·2025-04-23
CVE-2024-56406 Perl vulnerability
Title: Perl vulnerability
Summary: Perl could be made to crash or run programs if it processed specially
crafted data.
USN-7434-1 fixed a vulnerability in Perl. This update provides the
corresponding update for Ubuntu 25.04.
Original advisory details:
It was discovered that Perl incorrectly handled transliterating non-ASCII
bytes. A remote attacker could use this issue to cause Perl to crash,
resulting in a denial of service, or possibly execute arbitrary code.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Perl vulnerability
vendor_ubuntu·2025-04-14
CVE-2024-56406 Perl vulnerability
Title: Perl vulnerability
Summary: Perl could be made to crash or run programs if it processed specially
crafted data.
It was discovered that Perl incorrectly handled transliterating non-ASCII
bytes. A remote attacker could use this issue to cause Perl to crash,
resulting in a denial of service, or possibly execute arbitrary code.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
perl: Perl 5.34, 5.36, 5.38 and 5.40 are vulnerable to a heap buffer overflow when transliterating non-ASCII bytes
vendor_redhat·2025-04-13·CVSS 8.4
CVE-2024-56406 [HIGH] CWE-787 perl: Perl 5.34, 5.36, 5.38 and 5.40 are vulnerable to a heap buffer overflow when transliterating non-ASCII bytes
perl: Perl 5.34, 5.36, 5.38 and 5.40 are vulnerable to a heap buffer overflow when transliterating non-ASCII bytes
A heap buffer overflow vulnerability was discovered in Perl.
Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10.
When there are non-ASCII bytes in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`.
$ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;'
Segmentation fault (core dumped)
It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses.
A flaw was found in Perl. This vulnerability allows a heap buffer overflow, which can lead to denial of service and potential arbitr
BSD
OpenBSD 7.5 Errata 025: SECURITY FIX
bsd_advisories·2025-04-13·CVSS 8.4
CVE-2024-56406 [HIGH] OpenBSD 7.5 Errata 025: SECURITY FIX
OpenBSD 7.5 Errata 025: SECURITY FIX
025: SECURITY FIX: April 13, 2025
All architectures In Perl, non-ASCII bytes in the left-hand-side of the `tr` operator can overflow an insufficiently sized buffer. CVE-2024-56406
Microsoft
Perl is vulnerable to a heap buffer overflow when transliterating non-ASCII bytes
vendor_msrc·2025-04-08·CVSS 8.6
CVE-2024-56406 [HIGH] CWE-122 Perl is vulnerable to a heap buffer overflow when transliterating non-ASCII bytes
Perl is vulnerable to a heap buffer overflow when transliterating non-ASCII bytes
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
CPANSec: CPANSec
Customer Action Required: Yes
Remediation: CBL-Mariner Rele
Debian
CVE-2024-56406: perl - A heap buffer overflow vulnerability was discovered in Perl. Release branches ...
vendor_debian·2024·CVSS 8.4
CVE-2024-56406 [HIGH] CVE-2024-56406: perl - A heap buffer overflow vulnerability was discovered in Perl. Release branches ...
A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10. When there are non-ASCII bytes in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`. $ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;' Segmentation fault (core dumped) It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses.
Scope: local
bookworm: resolved (fixed in 5.36.0-7+deb12u2)
bullseye: resolved
forky: resolved (fixed in 5.40.1-3)
sid: resolved (fixed in 5.40.1-3)
trixie: resolved (fixed in 5.40.1-3)
GHSA
GHSA-p6jf-pv8c-623c: A heap buffer overflow vulnerability was discovered in Perl
ghsa_unreviewed·2025-04-13
CVE-2024-56406 [HIGH] CWE-122 GHSA-p6jf-pv8c-623c: A heap buffer overflow vulnerability was discovered in Perl
A heap buffer overflow vulnerability was discovered in Perl.
When there are non-ASCII bytes in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`.
$ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;'
Segmentation fault (core dumped)
It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses.
OSV
CVE-2024-56406: A heap buffer overflow vulnerability was discovered in Perl
osv·2025-04-13·CVSS 8.4
CVE-2024-56406 [HIGH] CVE-2024-56406: A heap buffer overflow vulnerability was discovered in Perl
A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10. When there are non-ASCII bytes in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`. $ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;' Segmentation fault (core dumped) It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses.
OSV
CVE-2024-56406: A heap buffer overflow vulnerability was discovered in Perl
osv·2025-04-13·CVSS 8.4
CVE-2024-56406 [HIGH] CVE-2024-56406: A heap buffer overflow vulnerability was discovered in Perl
A heap buffer overflow vulnerability was discovered in Perl.
Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10.
When there are non-ASCII bytes in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`.
$ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;'
Segmentation fault (core dumped)
It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses.
No detection rules found.
No public exploits indexed.
Qualys
Oracle Critical Patch Update, July 2025 Security Update Review
blogs_qualys·2025-07-16
Oracle Critical Patch Update, July 2025 Security Update Review
## Table of Contents
Qualys QID Coverage
Notable Oracle Vulnerabilities Patched
Oracle released its second quarterly edition of this year’s Critical Patch Update. The update received patches for 309 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-party components in Oracle products.
In this quarterly Oracle Critical Patch Update, Oracle Communications received the highest number of patches, 84, constituting about 27% of the total patches released. Oracle MySQL and Oracle Fusion Middleware followed, with 40 and 36 security patches.
228 of the 309 security patches provided by the July Critical Patch Update (about 74%) are for non-Oracle CVEs, su
Qualys
Oracle Critical Patch Update, July 2025 Security Update Review | Qualys
blogs_qualys·2025-07-16
Oracle Critical Patch Update, July 2025 Security Update Review | Qualys
#### Table of Contents
- Qualys QID Coverage
- Notable Oracle Vulnerabilities Patched
Oracle released its second quarterly edition of this year’s Critical Patch Update. The update received patches for 309 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-party components in Oracle products.
In this quarterly Oracle Critical Patch Update, Oracle Communications received the highest number of patches, 84, constituting about 27% of the total patches released. Oracle MySQL and Oracle Fusion Middleware followed, with 40 and 36 security patches.
228 of the 309 security patches provided by the July Critical Patch Update (about 74%) are for non-Oracle CVE
Bugzilla
CVE-2024-56406 perl: Perl 5.34, 5.36, 5.38 and 5.40 are vulnerable to a heap buffer overflow when transliterating non-ASCII bytes
bugzilla·2025-04-13·CVSS 8.4
CVE-2024-56406 [HIGH] CVE-2024-56406 perl: Perl 5.34, 5.36, 5.38 and 5.40 are vulnerable to a heap buffer overflow when transliterating non-ASCII bytes
CVE-2024-56406 perl: Perl 5.34, 5.36, 5.38 and 5.40 are vulnerable to a heap buffer overflow when transliterating non-ASCII bytes
A heap buffer overflow vulnerability was discovered in Perl.
When there are non-ASCII bytes in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`.
$ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;'
Segmentation fault (core dumped)
It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses.
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 10
Via RHSA-2025:7500 https://access.redhat.com/errata/RHSA-2025:7500
https://github.com/Perl/perl5/commit/87f42aa0e0096e9a346c9672aa3a0bd3bef8c1dd.patchhttps://metacpan.org/release/SHAY/perl-5.38.4/changeshttps://metacpan.org/release/SHAY/perl-5.40.2/changeshttp://www.openwall.com/lists/oss-security/2025/04/13/3http://www.openwall.com/lists/oss-security/2025/04/13/4http://www.openwall.com/lists/oss-security/2025/04/13/5
2025-04-13
Published