High Severity Vulnerability
This vulnerability has been rated as High severity. Immediate action is recommended.
CVE-2024-56406
HighVulnerability Description
A heap buffer overflow vulnerability was discovered in Perl.
Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10.
When there are non-ASCII bytes in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`.
$ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;'
Segmentation fault (core dumped)
It is believed that this vulnerability can enable Denial of Service and possibly Code Execution attacks on platforms that lack sufficient defenses.
CVSS Metrics
Common Vulnerability Scoring System
Vector String:
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Known Affected Software
69 configuration(s) from 1 vendor(s)
cpe:2.3:a:perl:perl:5.37.0:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.34.2:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.33.8:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.37.6:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.39.8:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.35.3:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.33.4:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.38.3:-:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.37.9:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.39.6:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.41.6:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.41.9:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.38.1:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.37.11:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.39.1:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.37.10:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.34.1:rc2:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.35.8:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.35.9:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.33.2:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.41.4:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.39.4:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.35.4:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.35.0:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.41.8:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.38.0:-:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.41.7:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.41.0:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.35.5:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.37.2:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.34.3:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.39.0:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.34.0:-:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.37.7:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.41.3:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.38.2:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.41.5:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.33.7:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.41.10:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.37.3:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.35.1:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.33.1:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.39.2:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.36.3:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.37.4:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.36.0:-:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.33.9:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.37.8:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.37.1:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.33.3:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.39.5:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.33.5:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.33.6:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.40.1:-:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.36.2:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.40.0:-:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.35.10:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.35.6:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.37.5:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.36.1:rc3:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.39.10:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.35.2:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.35.11:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.39.3:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.39.7:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.39.9:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.41.1:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.41.2:*:*:*:*:*:*:*
cpe:2.3:a:perl:perl:5.35.7:*:*:*:*:*:*:*
CPUAPR2026
Oracle Critical Patch Update Advisory - April 2026
CPUJAN2026
Oracle Critical Patch Update Advisory - January 2026
CPUOCT2025
Oracle Critical Patch Update Advisory - October 2025
2025-Apr-CVE-2024-56406
CVE-2024-56406: Perl is vulnerable to a heap buffer overflow when transliterating non-ASCII bytes
CPUJUL2025
Oracle Critical Patch Update Advisory - July 2025
References & Resources
-
https://github.com/Perl/perl5/commit/87f42aa0e0096e9a346c9672aa3a0bd3bef8c1dd.patch9b29abf9-4ab0-4765-b253-1875cd9b441e Patch
-
https://metacpan.org/release/SHAY/perl-5.38.4/changes9b29abf9-4ab0-4765-b253-1875cd9b441e Release Notes
-
https://metacpan.org/release/SHAY/perl-5.40.2/changes9b29abf9-4ab0-4765-b253-1875cd9b441e Release Notes
-
http://www.openwall.com/lists/oss-security/2025/04/13/3af854a3a-2127-422b-91ae-364da2661108 Mailing List
-
http://www.openwall.com/lists/oss-security/2025/04/13/4af854a3a-2127-422b-91ae-364da2661108 Mailing List
-
http://www.openwall.com/lists/oss-security/2025/04/13/5af854a3a-2127-422b-91ae-364da2661108 Mailing List
Severity Details
Weakness Type (CWE)
Heap-based Buffer Overflow
- Description
- A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
- Exploit Likelihood
- High
- Typical Severity
- High
- Abstraction Level
- Variant
Key Information
- Published Date
- April 13, 2025
