CVE-2025-40909

EUVD-2025-16506

30.05.2025, 13:15

Perl threads have a working directory race condition where file operations may target unintended paths.

If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running.

This may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit.

The bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
CPANSec	CNA	5.9 MEDIUM	LOCAL	LOW	NONE	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Base Score

CVSS 3.x

EPSS Score

Percentile: 29%

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
perl	perl	5.13.6 ≤ 𝑥 < 5.41.13	CNA

Debian Releases

Debian Product

Codename

perl

bookworm	5.36.0-7+deb12u3 fixed
bookworm (security)	vulnerable
bullseye	vulnerable
bullseye (security)	5.32.1-4+deb11u5 fixed
forky	5.40.1-8 fixed
sid	5.40.1-8 fixed
trixie	5.40.1-6 fixed

openSUSE / SLES Releases

openSUSE Product

Release

perl

suse enterprise desktop 15 SP6	5.26.1-150300.17.20.1 fixed
suse enterprise desktop 15 SP7	5.26.1-150300.17.20.1 fixed
suse enterprise sap 15 SP6	5.26.1-150300.17.20.1 fixed
suse enterprise sap 15 SP7	5.26.1-150300.17.20.1 fixed
suse enterprise server 15 SP4	5.26.1-150300.17.20.1 fixed
suse enterprise server 15 SP6	5.26.1-150300.17.20.1 fixed
suse enterprise server 15 SP7	5.26.1-150300.17.20.1 fixed

perl-base

suse enterprise desktop 15 SP6	5.26.1-150300.17.20.1 fixed
suse enterprise desktop 15 SP7	5.26.1-150300.17.20.1 fixed
suse enterprise sap 15 SP6	5.26.1-150300.17.20.1 fixed
suse enterprise sap 15 SP7	5.26.1-150300.17.20.1 fixed
suse enterprise server 15 SP4	5.26.1-150300.17.20.1 fixed
suse enterprise server 15 SP6	5.26.1-150300.17.20.1 fixed
suse enterprise server 15 SP7	5.26.1-150300.17.20.1 fixed

perl-base-32bit

suse enterprise desktop 15 SP6	5.26.1-150300.17.20.1 fixed
suse enterprise desktop 15 SP7	5.26.1-150300.17.20.1 fixed
suse enterprise sap 15 SP6	5.26.1-150300.17.20.1 fixed
suse enterprise sap 15 SP7	5.26.1-150300.17.20.1 fixed
suse enterprise server 15 SP4	5.26.1-150300.17.20.1 fixed
suse enterprise server 15 SP6	5.26.1-150300.17.20.1 fixed
suse enterprise server 15 SP7	5.26.1-150300.17.20.1 fixed

perl-core-DB_File

suse enterprise desktop 15 SP6	5.26.1-150300.17.20.1 fixed
suse enterprise desktop 15 SP7	5.26.1-150300.17.20.1 fixed
suse enterprise sap 15 SP6	5.26.1-150300.17.20.1 fixed
suse enterprise sap 15 SP7	5.26.1-150300.17.20.1 fixed
suse enterprise server 15 SP4	5.26.1-150300.17.20.1 fixed
suse enterprise server 15 SP6	5.26.1-150300.17.20.1 fixed
suse enterprise server 15 SP7	5.26.1-150300.17.20.1 fixed

perl-doc

suse enterprise server 15 SP4

5.26.1-150300.17.20.1

fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

perl

RHEL 8	4:5.26.3-423.el8_10 fixed
RHEL 9	4:5.32.1-481.1.el9_6 fixed

perl-Attribute-Handlers

RHEL 8	0:0.99-423.el8_10 fixed
RHEL 9	0:1.01-481.1.el9_6 fixed

perl-AutoLoader

RHEL 9

0:5.74-481.1.el9_6

fixed

perl-AutoSplit

RHEL 9

0:5.74-481.1.el9_6

fixed

perl-B

RHEL 9

0:1.80-481.1.el9_6

fixed

perl-Benchmark

RHEL 9

0:1.23-481.1.el9_6

fixed

perl-Class-Struct

RHEL 9

0:0.66-481.1.el9_6

fixed

perl-Config-Extensions

RHEL 9

0:0.03-481.1.el9_6

fixed

perl-DBM

RHEL 9

0:0.06-481.1.el9_6

fixed

perl-Devel-Peek

RHEL 8	0:1.26-423.el8_10 fixed
RHEL 9	0:1.28-481.1.el9_6 fixed

perl-Devel-SelfStubber

RHEL 8	0:1.06-423.el8_10 fixed
RHEL 9	0:1.06-481.1.el9_6 fixed

perl-DirHandle

RHEL 9

0:1.05-481.1.el9_6

fixed

perl-Dumpvalue

RHEL 9

0:2.27-481.1.el9_6

fixed

perl-DynaLoader

RHEL 9

0:1.47-481.1.el9_6

fixed

perl-English

RHEL 9

0:1.11-481.1.el9_6

fixed

perl-Errno

RHEL 8	0:1.28-423.el8_10 fixed
RHEL 9	0:1.30-481.1.el9_6 fixed

perl-ExtUtils-Constant

RHEL 9

0:0.25-481.1.el9_6

fixed

perl-ExtUtils-Embed

RHEL 8	0:1.34-423.el8_10 fixed
RHEL 9	0:1.35-481.1.el9_6 fixed

perl-ExtUtils-Miniperl

RHEL 8	0:1.06-423.el8_10 fixed
RHEL 9	0:1.09-481.1.el9_6 fixed

perl-Fcntl

RHEL 9

0:1.13-481.1.el9_6

fixed

perl-File-Basename

RHEL 9

0:2.85-481.1.el9_6

fixed

perl-File-Compare

RHEL 9

0:1.100.600-481.1.el9_6

fixed

perl-File-Copy

RHEL 9

0:2.34-481.1.el9_6

fixed

perl-File-DosGlob

RHEL 9

0:1.12-481.1.el9_6

fixed

perl-File-Find

RHEL 9

0:1.37-481.1.el9_6

fixed

perl-File-stat

RHEL 9

0:1.09-481.1.el9_6

fixed

perl-FileCache

RHEL 9

0:1.10-481.1.el9_6

fixed

perl-FileHandle

RHEL 9

0:2.03-481.1.el9_6

fixed

perl-FindBin

RHEL 9

0:1.51-481.1.el9_6

fixed

perl-GDBM

RHEL 9

0:1.18-481.1.el9_6

fixed

perl-Getopt-Std

RHEL 9

0:1.12-481.1.el9_6

fixed

perl-Hash-Util

RHEL 9

0:0.23-481.1.el9_6

fixed

perl-Hash-Util-FieldHash

RHEL 9

0:1.20-481.1.el9_6

fixed

perl-I18N-Collate

RHEL 9

0:1.02-481.1.el9_6

fixed

perl-I18N-LangTags

RHEL 9

0:0.44-481.1.el9_6

fixed

perl-I18N-Langinfo

RHEL 9

0:0.19-481.1.el9_6

fixed

perl-IO

RHEL 8	0:1.38-423.el8_10 fixed
RHEL 9	0:1.43-481.1.el9_6 fixed

perl-IO-Zlib

RHEL 8

1:1.10-423.el8_10

fixed

perl-IPC-Open3

RHEL 9

0:1.21-481.1.el9_6

fixed

perl-Locale-Maketext-Simple

RHEL 8	1:0.21-423.el8_10 fixed
RHEL 9	1:0.21-481.1.el9_6 fixed

perl-Math-Complex

RHEL 8	0:1.59-423.el8_10 fixed
RHEL 9	0:1.59-481.1.el9_6 fixed

perl-Memoize

RHEL 8	0:1.03-423.el8_10 fixed
RHEL 9	0:1.03-481.1.el9_6 fixed

perl-Module-Loaded

RHEL 8	1:0.08-423.el8_10 fixed
RHEL 9	1:0.08-481.1.el9_6 fixed

perl-NDBM

RHEL 9

0:1.15-481.1.el9_6

fixed

perl-NEXT

RHEL 9

0:0.67-481.1.el9_6

fixed

perl-Net

RHEL 9

0:1.02-481.1.el9_6

fixed

perl-Net-Ping

RHEL 8

0:2.55-423.el8_10

fixed

perl-ODBM

RHEL 9

0:1.16-481.1.el9_6

fixed

perl-Opcode

RHEL 9

0:1.48-481.1.el9_6

fixed

perl-POSIX

RHEL 9

0:1.94-481.1.el9_6

fixed

perl-Pod-Functions

RHEL 9

0:1.13-481.1.el9_6

fixed

perl-Pod-Html

RHEL 8	0:1.22.02-423.el8_10 fixed
RHEL 9	0:1.25-481.1.el9_6 fixed

perl-Safe

RHEL 9

0:2.41-481.1.el9_6

fixed

perl-Search-Dict

RHEL 9

0:1.07-481.1.el9_6

fixed

perl-SelectSaver

RHEL 9

0:1.02-481.1.el9_6

fixed

perl-SelfLoader

RHEL 8	0:1.23-423.el8_10 fixed
RHEL 9	0:1.26-481.1.el9_6 fixed

perl-Symbol

RHEL 9

0:1.08-481.1.el9_6

fixed

perl-Sys-Hostname

RHEL 9

0:1.23-481.1.el9_6

fixed

perl-Term-Complete

RHEL 9

0:1.403-481.1.el9_6

fixed

perl-Term-ReadLine

RHEL 9

0:1.17-481.1.el9_6

fixed

perl-Test

RHEL 8	0:1.30-423.el8_10 fixed
RHEL 9	0:1.31-481.1.el9_6 fixed

perl-Text-Abbrev

RHEL 9

0:1.02-481.1.el9_6

fixed

perl-Thread

RHEL 9

0:3.05-481.1.el9_6

fixed

perl-Thread-Semaphore

RHEL 9

0:2.13-481.1.el9_6

fixed

perl-Tie

RHEL 9

0:4.6-481.1.el9_6

fixed

perl-Tie-File

RHEL 9

0:1.06-481.1.el9_6

fixed

perl-Tie-Memoize

RHEL 9

0:1.1-481.1.el9_6

fixed

perl-Time

RHEL 9

0:1.03-481.1.el9_6

fixed

perl-Time-Piece

RHEL 8	0:1.31-423.el8_10 fixed
RHEL 9	0:1.3401-481.1.el9_6 fixed

perl-Unicode-UCD

RHEL 9

0:0.75-481.1.el9_6

fixed

perl-User-pwent

RHEL 9

0:1.03-481.1.el9_6

fixed

perl-autouse

RHEL 9

0:1.11-481.1.el9_6

fixed

perl-base

RHEL 9

0:2.27-481.1.el9_6

fixed

perl-blib

RHEL 9

0:1.07-481.1.el9_6

fixed

perl-debugger

RHEL 9

0:1.56-481.1.el9_6

fixed

perl-deprecate

RHEL 9

0:0.04-481.1.el9_6

fixed

perl-devel

RHEL 8	4:5.26.3-423.el8_10 fixed
RHEL 9	4:5.32.1-481.1.el9_6 fixed

perl-diagnostics

RHEL 9

0:1.37-481.1.el9_6

fixed

perl-doc

RHEL 9

0:5.32.1-481.1.el9_6

fixed

perl-encoding-warnings

RHEL 9

0:0.13-481.1.el9_6

fixed

perl-fields

RHEL 9

0:2.27-481.1.el9_6

fixed

perl-filetest

RHEL 9

0:1.03-481.1.el9_6

fixed

perl-if

RHEL 9

0:0.60.800-481.1.el9_6

fixed

perl-interpreter

RHEL 8	4:5.26.3-423.el8_10 fixed
RHEL 9	4:5.32.1-481.1.el9_6 fixed

perl-less

RHEL 9

0:0.03-481.1.el9_6

fixed

perl-lib

RHEL 9

0:0.65-481.1.el9_6

fixed

perl-libnetcfg

RHEL 8	4:5.26.3-423.el8_10 fixed
RHEL 9	4:5.32.1-481.1.el9_6 fixed

perl-libs

RHEL 8	4:5.26.3-423.el8_10 fixed
RHEL 9	4:5.32.1-481.1.el9_6 fixed

perl-locale

RHEL 9

0:1.09-481.1.el9_6

fixed

perl-macros

RHEL 8	4:5.26.3-423.el8_10 fixed
RHEL 9	4:5.32.1-481.1.el9_6 fixed

perl-meta-notation

RHEL 9

0:5.32.1-481.1.el9_6

fixed

perl-mro

RHEL 9

0:1.23-481.1.el9_6

fixed

perl-open

RHEL 8	0:1.11-423.el8_10 fixed
RHEL 9	0:1.12-481.1.el9_6 fixed

perl-overload

RHEL 9

0:1.31-481.1.el9_6

fixed

perl-overloading

RHEL 9

0:0.02-481.1.el9_6

fixed

perl-ph

RHEL 9

0:5.32.1-481.1.el9_6

fixed

perl-sigtrap

RHEL 9

0:1.09-481.1.el9_6

fixed

perl-sort

RHEL 9

0:2.04-481.1.el9_6

fixed

perl-subs

RHEL 9

0:1.03-481.1.el9_6

fixed

perl-tests

RHEL 8

4:5.26.3-423.el8_10

fixed

perl-utils

RHEL 8	0:5.26.3-423.el8_10 fixed
RHEL 9	0:5.32.1-481.1.el9_6 fixed

perl-vars

RHEL 9

0:1.05-481.1.el9_6

fixed

perl-vmsish

RHEL 9

0:1.04-481.1.el9_6

fixed

Amazon Linux Releases

Amazon Package

Release

perl

Amazon Linux 1	4:5.16.3-294.45.amzn1 fixed
Amazon Linux 2	4:5.16.3-299.amzn2.0.3 fixed
Amazon Linux 2023	4:5.32.1-477.amzn2023.0.7 fixed

perl-Attribute-Handlers

Amazon Linux 2023

0:1.01-477.amzn2023.0.7

fixed

perl-AutoLoader

Amazon Linux 2023

0:5.74-477.amzn2023.0.7

fixed

perl-AutoSplit

Amazon Linux 2023

0:5.74-477.amzn2023.0.7

fixed

perl-B

Amazon Linux 2023

0:1.80-477.amzn2023.0.7

fixed

perl-B-debuginfo

Amazon Linux 2023

0:1.80-477.amzn2023.0.7

fixed

perl-Benchmark

Amazon Linux 2023

0:1.23-477.amzn2023.0.7

fixed

perl-CPAN

Amazon Linux 1	0:1.9800-294.45.amzn1 fixed
Amazon Linux 2	0:1.9800-299.amzn2.0.3 fixed

perl-Class-Struct

Amazon Linux 2023

0:0.66-477.amzn2023.0.7

fixed

perl-Config-Extensions

Amazon Linux 2023

0:0.03-477.amzn2023.0.7

fixed

perl-DBM_Filter

Amazon Linux 2023

0:0.06-477.amzn2023.0.7

fixed

perl-Devel-Peek

Amazon Linux 2023

0:1.28-477.amzn2023.0.7

fixed

perl-Devel-Peek-debuginfo

Amazon Linux 2023

0:1.28-477.amzn2023.0.7

fixed

perl-Devel-SelfStubber

Amazon Linux 2023

0:1.06-477.amzn2023.0.7

fixed

perl-DirHandle

Amazon Linux 2023

0:1.05-477.amzn2023.0.7

fixed

perl-Dumpvalue

Amazon Linux 2023

0:2.27-477.amzn2023.0.7

fixed

perl-DynaLoader

Amazon Linux 2023

0:1.47-477.amzn2023.0.7

fixed

perl-English

Amazon Linux 2023

0:1.11-477.amzn2023.0.7

fixed

perl-Errno

Amazon Linux 2023

0:1.30-477.amzn2023.0.7

fixed

perl-ExtUtils-CBuilder

Amazon Linux 1	1:0.28.2.6-294.45.amzn1 fixed
Amazon Linux 2	1:0.28.2.6-299.amzn2.0.3 fixed

perl-ExtUtils-Constant

Amazon Linux 2023

0:0.25-477.amzn2023.0.7

fixed

perl-ExtUtils-Embed

Amazon Linux 1	0:1.30-294.45.amzn1 fixed
Amazon Linux 2	0:1.30-299.amzn2.0.3 fixed
Amazon Linux 2023	0:1.35-477.amzn2023.0.7 fixed

perl-ExtUtils-Install

Amazon Linux 1	0:1.58-294.45.amzn1 fixed
Amazon Linux 2	0:1.58-299.amzn2.0.3 fixed

perl-ExtUtils-Miniperl

Amazon Linux 2023

0:1.09-477.amzn2023.0.7

fixed

perl-Fcntl

Amazon Linux 2023

0:1.13-477.amzn2023.0.7

fixed

perl-Fcntl-debuginfo

Amazon Linux 2023

0:1.13-477.amzn2023.0.7

fixed

perl-File-Basename

Amazon Linux 2023

0:2.85-477.amzn2023.0.7

fixed

perl-File-Compare

Amazon Linux 2023

0:1.100.600-477.amzn2023.0.7

fixed

perl-File-Copy

Amazon Linux 2023

0:2.34-477.amzn2023.0.7

fixed

perl-File-DosGlob

Amazon Linux 2023

0:1.12-477.amzn2023.0.7

fixed

perl-File-DosGlob-debuginfo

Amazon Linux 2023

0:1.12-477.amzn2023.0.7

fixed

perl-File-Find

Amazon Linux 2023

0:1.37-477.amzn2023.0.7

fixed

perl-File-stat

Amazon Linux 2023

0:1.09-477.amzn2023.0.7

fixed

perl-FileCache

Amazon Linux 2023

0:1.10-477.amzn2023.0.7

fixed

perl-FileHandle

Amazon Linux 2023

0:2.03-477.amzn2023.0.7

fixed

perl-FindBin

Amazon Linux 2023

0:1.51-477.amzn2023.0.7

fixed

perl-GDBM_File

Amazon Linux 2023

0:1.18-477.amzn2023.0.7

fixed

perl-GDBM_File-debuginfo

Amazon Linux 2023

0:1.18-477.amzn2023.0.7

fixed

perl-Getopt-Std

Amazon Linux 2023

0:1.12-477.amzn2023.0.7

fixed

perl-Hash-Util

Amazon Linux 2023

0:0.23-477.amzn2023.0.7

fixed

perl-Hash-Util-FieldHash

Amazon Linux 2023

0:1.20-477.amzn2023.0.7

fixed

perl-Hash-Util-FieldHash-debuginfo

Amazon Linux 2023

0:1.20-477.amzn2023.0.7

fixed

perl-Hash-Util-debuginfo

Amazon Linux 2023

0:0.23-477.amzn2023.0.7

fixed

perl-I18N-Collate

Amazon Linux 2023

0:1.02-477.amzn2023.0.7

fixed

perl-I18N-LangTags

Amazon Linux 2023

0:0.44-477.amzn2023.0.7

fixed

perl-I18N-Langinfo

Amazon Linux 2023

0:0.19-477.amzn2023.0.7

fixed

perl-I18N-Langinfo-debuginfo

Amazon Linux 2023

0:0.19-477.amzn2023.0.7

fixed

perl-IO

Amazon Linux 2023

0:1.43-477.amzn2023.0.7

fixed

perl-IO-Zlib

Amazon Linux 1	1:1.10-294.45.amzn1 fixed
Amazon Linux 2	1:1.10-299.amzn2.0.3 fixed

perl-IO-debuginfo

Amazon Linux 2023

0:1.43-477.amzn2023.0.7

fixed

perl-IPC-Open3

Amazon Linux 2023

0:1.21-477.amzn2023.0.7

fixed

perl-Locale-Maketext-Simple

Amazon Linux 1	1:0.21-294.45.amzn1 fixed
Amazon Linux 2	1:0.21-299.amzn2.0.3 fixed
Amazon Linux 2023	1:0.21-477.amzn2023.0.7 fixed

perl-Math-Complex

Amazon Linux 2023

0:1.59-477.amzn2023.0.7

fixed

perl-Memoize

Amazon Linux 2023

0:1.03-477.amzn2023.0.7

fixed

perl-Module-CoreList

Amazon Linux 1	1:2.76.02-294.45.amzn1 fixed
Amazon Linux 2	1:2.76.02-299.amzn2.0.3 fixed

perl-Module-Loaded

Amazon Linux 1	1:0.08-294.45.amzn1 fixed
Amazon Linux 2	1:0.08-299.amzn2.0.3 fixed
Amazon Linux 2023	1:0.08-477.amzn2023.0.7 fixed

perl-NDBM_File

Amazon Linux 2023

0:1.15-477.amzn2023.0.7

fixed

perl-NDBM_File-debuginfo

Amazon Linux 2023

0:1.15-477.amzn2023.0.7

fixed

perl-NEXT

Amazon Linux 2023

0:0.67-477.amzn2023.0.7

fixed

perl-Net

Amazon Linux 2023

0:1.02-477.amzn2023.0.7

fixed

perl-ODBM_File

Amazon Linux 2023

0:1.16-477.amzn2023.0.7

fixed

perl-ODBM_File-debuginfo

Amazon Linux 2023

0:1.16-477.amzn2023.0.7

fixed

perl-Object-Accessor

Amazon Linux 1	1:0.42-294.45.amzn1 fixed
Amazon Linux 2	1:0.42-299.amzn2.0.3 fixed

perl-Opcode

Amazon Linux 2023

0:1.48-477.amzn2023.0.7

fixed

perl-Opcode-debuginfo

Amazon Linux 2023

0:1.48-477.amzn2023.0.7

fixed

perl-POSIX

Amazon Linux 2023

0:1.94-477.amzn2023.0.7

fixed

perl-POSIX-debuginfo

Amazon Linux 2023

0:1.94-477.amzn2023.0.7

fixed

perl-Package-Constants

Amazon Linux 1	1:0.02-294.45.amzn1 fixed
Amazon Linux 2	1:0.02-299.amzn2.0.3 fixed

perl-Pod-Escapes

Amazon Linux 1	1:1.04-294.45.amzn1 fixed
Amazon Linux 2	1:1.04-299.amzn2.0.3 fixed

perl-Pod-Functions

Amazon Linux 2023

0:1.13-477.amzn2023.0.7

fixed

perl-Pod-Html

Amazon Linux 2023

0:1.25-477.amzn2023.0.7

fixed

perl-Safe

Amazon Linux 2023

0:2.41-477.amzn2023.0.7

fixed

perl-Search-Dict

Amazon Linux 2023

0:1.07-477.amzn2023.0.7

fixed

perl-SelectSaver

Amazon Linux 2023

0:1.02-477.amzn2023.0.7

fixed

perl-SelfLoader

Amazon Linux 2023

0:1.26-477.amzn2023.0.7

fixed

perl-Symbol

Amazon Linux 2023

0:1.08-477.amzn2023.0.7

fixed

perl-Sys-Hostname

Amazon Linux 2023

0:1.23-477.amzn2023.0.7

fixed

perl-Sys-Hostname-debuginfo

Amazon Linux 2023

0:1.23-477.amzn2023.0.7

fixed

perl-Term-Complete

Amazon Linux 2023

0:1.403-477.amzn2023.0.7

fixed

perl-Term-ReadLine

Amazon Linux 2023

0:1.17-477.amzn2023.0.7

fixed

perl-Test

Amazon Linux 2023

0:1.31-477.amzn2023.0.7

fixed

perl-Text-Abbrev

Amazon Linux 2023

0:1.02-477.amzn2023.0.7

fixed

perl-Thread

Amazon Linux 2023

0:3.05-477.amzn2023.0.7

fixed

perl-Thread-Semaphore

Amazon Linux 2023

0:2.13-477.amzn2023.0.7

fixed

perl-Tie

Amazon Linux 2023

0:4.6-477.amzn2023.0.7

fixed

perl-Tie-File

Amazon Linux 2023

0:1.06-477.amzn2023.0.7

fixed

perl-Tie-Memoize

Amazon Linux 2023

0:1.1-477.amzn2023.0.7

fixed

perl-Time

Amazon Linux 2023

0:1.03-477.amzn2023.0.7

fixed

perl-Time-Piece

Amazon Linux 1	0:1.20.1-294.45.amzn1 fixed
Amazon Linux 2	0:1.20.1-299.amzn2.0.3 fixed
Amazon Linux 2023	0:1.3401-477.amzn2023.0.7 fixed

perl-Time-Piece-debuginfo

Amazon Linux 2023

0:1.3401-477.amzn2023.0.7

fixed

perl-Unicode-UCD

Amazon Linux 2023

0:0.75-477.amzn2023.0.7

fixed

perl-User-pwent

Amazon Linux 2023

0:1.03-477.amzn2023.0.7

fixed

perl-autouse

Amazon Linux 2023

0:1.11-477.amzn2023.0.7

fixed

perl-base

Amazon Linux 2023

0:2.27-477.amzn2023.0.7

fixed

perl-blib

Amazon Linux 2023

0:1.07-477.amzn2023.0.7

fixed

perl-core

Amazon Linux 1	0:5.16.3-294.45.amzn1 fixed
Amazon Linux 2	0:5.16.3-299.amzn2.0.3 fixed

perl-debugger

Amazon Linux 2023

0:1.56-477.amzn2023.0.7

fixed

perl-debuginfo

Amazon Linux 1	4:5.16.3-294.45.amzn1 fixed
Amazon Linux 2	4:5.16.3-299.amzn2.0.3 fixed
Amazon Linux 2023	4:5.32.1-477.amzn2023.0.7 fixed

perl-debugsource

Amazon Linux 2023

4:5.32.1-477.amzn2023.0.7

fixed

perl-deprecate

Amazon Linux 2023

0:0.04-477.amzn2023.0.7

fixed

perl-devel

Amazon Linux 1	4:5.16.3-294.45.amzn1 fixed
Amazon Linux 2	4:5.16.3-299.amzn2.0.3 fixed
Amazon Linux 2023	4:5.32.1-477.amzn2023.0.7 fixed

perl-diagnostics

Amazon Linux 2023

0:1.37-477.amzn2023.0.7

fixed

perl-doc

Amazon Linux 2023

0:5.32.1-477.amzn2023.0.7

fixed

perl-encoding-warnings

Amazon Linux 2023

0:0.13-477.amzn2023.0.7

fixed

perl-fields

Amazon Linux 2023

0:2.27-477.amzn2023.0.7

fixed

perl-filetest

Amazon Linux 2023

0:1.03-477.amzn2023.0.7

fixed

perl-if

Amazon Linux 2023

0:0.60.800-477.amzn2023.0.7

fixed

perl-interpreter

Amazon Linux 2023

4:5.32.1-477.amzn2023.0.7

fixed

perl-interpreter-debuginfo

Amazon Linux 2023

4:5.32.1-477.amzn2023.0.7

fixed

perl-less

Amazon Linux 2023

0:0.03-477.amzn2023.0.7

fixed

perl-lib

Amazon Linux 2023

0:0.65-477.amzn2023.0.7

fixed

perl-libnetcfg

Amazon Linux 2023

4:5.32.1-477.amzn2023.0.7

fixed

perl-libs

Amazon Linux 1	4:5.16.3-294.45.amzn1 fixed
Amazon Linux 2	4:5.16.3-299.amzn2.0.3 fixed
Amazon Linux 2023	4:5.32.1-477.amzn2023.0.7 fixed

perl-libs-debuginfo

Amazon Linux 2023

4:5.32.1-477.amzn2023.0.7

fixed

perl-locale

Amazon Linux 2023

0:1.09-477.amzn2023.0.7

fixed

perl-macros

Amazon Linux 1	4:5.16.3-294.45.amzn1 fixed
Amazon Linux 2	4:5.16.3-299.amzn2.0.3 fixed
Amazon Linux 2023	4:5.32.1-477.amzn2023.0.7 fixed

perl-meta-notation

Amazon Linux 2023

0:5.32.1-477.amzn2023.0.7

fixed

perl-mro

Amazon Linux 2023

0:1.23-477.amzn2023.0.7

fixed

perl-mro-debuginfo

Amazon Linux 2023

0:1.23-477.amzn2023.0.7

fixed

perl-open

Amazon Linux 2023

0:1.12-477.amzn2023.0.7

fixed

perl-overload

Amazon Linux 2023

0:1.31-477.amzn2023.0.7

fixed

perl-overloading

Amazon Linux 2023

0:0.02-477.amzn2023.0.7

fixed

perl-ph

Amazon Linux 2023

0:5.32.1-477.amzn2023.0.7

fixed

perl-sigtrap

Amazon Linux 2023

0:1.09-477.amzn2023.0.7

fixed

perl-sort

Amazon Linux 2023

0:2.04-477.amzn2023.0.7

fixed

perl-subs

Amazon Linux 2023

0:1.03-477.amzn2023.0.7

fixed

perl-tests

Amazon Linux 1	4:5.16.3-294.45.amzn1 fixed
Amazon Linux 2	4:5.16.3-299.amzn2.0.3 fixed
Amazon Linux 2023	4:5.32.1-477.amzn2023.0.7 fixed

perl-utils

Amazon Linux 2023

0:5.32.1-477.amzn2023.0.7

fixed

perl-vars

Amazon Linux 2023

0:1.05-477.amzn2023.0.7

fixed

perl-vmsish

Amazon Linux 2023

0:1.04-477.amzn2023.0.7

fixed

Azure Linux Releases

Azure Package

Release

perl

Azure Linux 3.0	0:5.38.2-509.azl3 fixed
CBL-Mariner 2.0	0:5.34.1-491.cm2 fixed

Common Weakness Enumeration

CWE-426 - Untrusted Search Path
The application searches for critical resources using an externally-supplied search path that can point to resources that are not under the application's direct control.

References

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1098226

https://github.com/Perl/perl5/commit/11a11ecf4bea72b17d250cfb43c897be1341861e

https://github.com/Perl/perl5/commit/918bfff86ca8d6d4e4ec5b30994451e0bd74aba9.patch

https://github.com/Perl/perl5/issues/10387

https://github.com/Perl/perl5/issues/23010

https://perldoc.perl.org/5.14.0/perl5136delta#Directory-handles-not-copied-to-threads

https://www.openwall.com/lists/oss-security/2025/05/22/2

http://seclists.org/fulldisclosure/2025/Sep/53

http://seclists.org/fulldisclosure/2025/Sep/54

http://seclists.org/fulldisclosure/2025/Sep/55

http://www.openwall.com/lists/oss-security/2025/05/23/1

http://www.openwall.com/lists/oss-security/2025/05/30/4

http://www.openwall.com/lists/oss-security/2025/06/02/2

http://www.openwall.com/lists/oss-security/2025/06/02/5

http://www.openwall.com/lists/oss-security/2025/06/02/6

http://www.openwall.com/lists/oss-security/2025/06/02/7

http://www.openwall.com/lists/oss-security/2025/06/03/1

https://lists.debian.org/debian-lts-announce/2026/04/msg00018.html