CVE-2026-13221

Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.

• CWE-190

• https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patchPatch
• https://github.com/Perl/perl5/issues/23388Issue Tracking
• http://www.openwall.com/lists/oss-security/2026/07/13/5Mailing List, Patch, Third Party Advisory

Published

Jul 13, 2026

Last Modified

Jul 14, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-13207FUXA versions 1.3.1 and prior contain an authentication bypa…8.7
• CVE-2026-13208A flaw was found in KubeVirt's virt-handler domain notify se…6.5
• CVE-2026-1321The Membership Plugin – Restrict Content plugin for WordPres…8.1
• CVE-2026-13211The genucenter web interface before version 8.0p11 unnecessa…4.3
• CVE-2026-13218A flaw was found in KubeVirt's virt-handler network cache ha…4.2
• CVE-2026-1322GitLab has remediated an issue in GitLab CE/EE affecting all…8.1
• CVE-2026-13222Our payment integration with Oppwa-based payment methods did…6.3
• CVE-2026-13223Our payment integration with Computop-based payment methods …6.3
• CVE-2026-13225Malicious HTML content could be injected into the email addr…5.3
• CVE-2026-13226The Groundhogg — CRM, Newsletters, and Marketing Automation …6.5
• CVE-2026-13227An Improper Authorization vulnerability exists in ERPNext ve…7.1
• CVE-2026-13228The LatePoint – Calendar Booking Plugin for Appointments and…8.8