Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer. Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure.

euleros EulerOS-SA-2026-3662: An update for perl-Socket is now available for EulerOS Virtualization release 2.12.0

euleros EulerOS-SA-2026-3657: An update for perl is now available for EulerOS Virtualization release 2.12.0

euleros EulerOS-SA-2026-3608: An update for perl-Socket is now available for EulerOS Virtualization release 2.12.1

ubuntu_linux USN-8675-1: Ubuntu 14.04 LTS / Ubuntu 16.04 LTS / Ubuntu 18.04 LTS / Ubuntu 20.04 LTS / Ubuntu 22.04 LTS / Ubuntu Pro Realtime 22.04 LTS : Perl vulnerabilities (USN-8675-1)

ubuntu_linux USN-8684-1: Ubuntu 24.04 LTS / Ubuntu Pro Realtime 24.04 LTS : Perl vulnerabilities (USN-8684-1)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2161 advisory.

    Socket versions before 2.041 for Perl have an out-of-bounds heap read.

    In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read,     so the check tests the byte length carried over from the preceding multiaddr argument instead. Both     addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the     source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4     bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.

    Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into     the returned packed structure. (CVE-2026-12087)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Socket versions before 2.041 for Perl have an out-of-bounds heap read.

    In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read,     so the check tests the byte length carried over from the preceding multiaddr argument instead. Both     addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the     source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4     bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.

    Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into     the returned packed structure.(CVE-2026-12087)

Tenable has extracted the preceding description block directly from the EulerOS perl security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the perl-Socket packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Socket versions before 2.041 for Perl have an out-of-bounds heap read.

    In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read,     so the check tests the byte length carried over from the preceding multiaddr argument instead. Both     addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the     source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4     bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.

    Calling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into     the returned packed structure.(CVE-2026-12087)

Tenable has extracted the preceding description block directly from the EulerOS perl-Socket security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ59566. It is, therefore, affected by multiple vulnerabilities as referenced in the IJ59566 advisory.

  - IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous     delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP     server to induce loading and instantation of arbitrary classes. (CVE-2026-8400)

  - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service     due to a stack-based buffer overflow. (CVE-2026-18828)

  - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due     to a stack-based buffer overflow. (CVE-2026-16872, CVE-2026-17122, CVE-2026-17138)

  - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due     to a stack buffer overflow. (CVE-2026-16841, CVE-2026-16862, CVE-2026-16864, CVE-2026-16885,     CVE-2026-16894, CVE-2026-16913, CVE-2026-17157)

  - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due     to a use-after-free vulnerability. (CVE-2026-17118)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ59564. It is, therefore, affected by multiple vulnerabilities as referenced in the IJ59564 advisory.

  - IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous     delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP     server to induce loading and instantation of arbitrary classes. (CVE-2026-8400)

  - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service     due to a stack-based buffer overflow. (CVE-2026-18828)

  - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due     to a stack-based buffer overflow. (CVE-2026-16872, CVE-2026-17122, CVE-2026-17138)

  - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due     to a stack buffer overflow. (CVE-2026-16841, CVE-2026-16862, CVE-2026-16864, CVE-2026-16885,     CVE-2026-16894, CVE-2026-16913, CVE-2026-17157)

  - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due     to a use-after-free vulnerability. (CVE-2026-17118)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ59563. It is, therefore, affected by multiple vulnerabilities as referenced in the IJ59563 advisory.

  - IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous     delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP     server to induce loading and instantation of arbitrary classes. (CVE-2026-8400)

  - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service     due to a stack-based buffer overflow. (CVE-2026-18828)

  - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due     to a stack-based buffer overflow. (CVE-2026-16872, CVE-2026-17122, CVE-2026-17138)

  - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due     to a stack buffer overflow. (CVE-2026-16841, CVE-2026-16862, CVE-2026-16864, CVE-2026-16885,     CVE-2026-16894, CVE-2026-16913, CVE-2026-17157)

  - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due     to a use-after-free vulnerability. (CVE-2026-17118)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AIX installed on the remote host is prior to APAR IJ59565. It is, therefore, affected by multiple vulnerabilities as referenced in the IJ59565 advisory.

  - IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous     delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP     server to induce loading and instantation of arbitrary classes. (CVE-2026-8400)

  - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service     due to a stack-based buffer overflow. (CVE-2026-18828)

  - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due     to a stack-based buffer overflow. (CVE-2026-16872, CVE-2026-17122, CVE-2026-17138)

  - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due     to a stack buffer overflow. (CVE-2026-16841, CVE-2026-16862, CVE-2026-16864, CVE-2026-16885,     CVE-2026-16894, CVE-2026-16913, CVE-2026-17157)

  - IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due     to a use-after-free vulnerability. (CVE-2026-17118)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3558-1 advisory.

    - CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on     32-bit builds       (bsc#1266304).
    - CVE-2026-12087: `Socket`'s `pack_ip_mreq_source()` can copy adjacent heap memory into the returned     packed structure       (bsc#1268349).
    - CVE-2026-57432: an integer overflow in `S_measure_struct` leads to an out-of-bounds heap read in `pack`     and `unpack`       (bsc#1271372).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3540-1 advisory.

    - CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on     32-bit builds       (bsc#1266304).
    - CVE-2026-12087: `Socket`'s `pack_ip_mreq_source()` can copy adjacent heap memory into the returned     packed structure       (bsc#1268349).
    - CVE-2026-57432: an integer overflow in `S_measure_struct` leads to an out-of-bounds heap read in `pack`     and `unpack`       (bsc#1271372).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22847-1 advisory.

    - CVE-2025-15649: `IO:Uncompress:Unzip` propagates uncaught exception when parsing zip header with     malformed DOS date       (bsc#1266361).
    - CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on     32-bit builds       (bsc#1266304).
    - CVE-2026-12087: `Socket`'s `pack_ip_mreq_source()` can copy adjacent heap memory into the returned     packed structure       (bsc#1268349).
    - CVE-2026-57432: an integer overflow in `S_measure_struct` leads to an out-of-bounds heap read in `pack`     and `unpack`       (bsc#1271372).
    - CVE-2026-13221: regex trie branch-count overflow leads to silent false-positive/negative pattern     matching       (bsc#1271386).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21411-1 advisory.

    - CVE-2025-15649: `IO:Uncompress:Unzip` propagates uncaught exception when parsing zip header with     malformed DOS date       (bsc#1266361).
    - CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on     32-bit builds       (bsc#1266304).
    - CVE-2026-12087: `Socket`'s `pack_ip_mreq_source()` can copy adjacent heap memory into the returned     packed structure       (bsc#1268349).
    - CVE-2026-57432: an integer overflow in `S_measure_struct` leads to an out-of-bounds heap read in `pack`     and `unpack`       (bsc#1271372).
    - CVE-2026-13221: regex trie branch-count overflow leads to silent false-positive/negative pattern     matching       (bsc#1271386).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-7df6c5acad advisory.

    2.041- BUGFIXES - Fix reuse of `STRLEN len` variable in pack_ip_mreq_source()



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-91d6cb99f7 advisory.

    2.041- BUGFIXES - Fix reuse of `STRLEN len` variable in pack_ip_mreq_source()



Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source()     checks the length of its source argument before the argument is read, so the check tests the byte length     carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a     valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte     imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy     reads up to 3 bytes past the end of its buffer. Calling pack_ip_mreq_source() with a source value shorter     than 4 bytes copies adjacent heap memory into the returned packed structure. (CVE-2026-12087)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
345769	Amazon Linux 2023 : perl-Socket, perl-Socket-tests (ALAS2023-2026-2161)	Nessus	Amazon Linux Local Security Checks	Local	critical
343725	EulerOS 2.0 SP12 : perl (EulerOS-SA-2026-3289)	Nessus	Huawei Local Security Checks	Local	critical
343712	EulerOS 2.0 SP12 : perl-Socket (EulerOS-SA-2026-3296)	Nessus	Huawei Local Security Checks	Local	critical
343701	EulerOS 2.0 SP12 : perl (EulerOS-SA-2026-3364)	Nessus	Huawei Local Security Checks	Local	critical
343682	EulerOS 2.0 SP12 : perl-Socket (EulerOS-SA-2026-3371)	Nessus	Huawei Local Security Checks	Local	critical
338726	AIX : Multiple Vulnerabilities (IJ59566)	Nessus	AIX Local Security Checks	Local	medium
338725	AIX : Multiple Vulnerabilities (IJ59564)	Nessus	AIX Local Security Checks	Local	medium
338724	AIX : Multiple Vulnerabilities (IJ59563)	Nessus	AIX Local Security Checks	Local	medium
338723	AIX : Multiple Vulnerabilities (IJ59565)	Nessus	AIX Local Security Checks	Local	medium
334786	SUSE SLED15: perl / perl-32bit / perl-base / perl-base-32bit / perl-core-DB_File / etc (SUSE-SU-2026:3558-1)	Nessus	SuSE Local Security Checks	Local	critical
334468	SUSE SLES12 Security Update : perl (SUSE-SU-2026:3540-1)	Nessus	SuSE Local Security Checks	Local	critical
330290	SUSE SLES16 Security Update : perl (SUSE-SU-2026:22847-1)	Nessus	SuSE Local Security Checks	Local	critical
329512	openSUSE 16 Security Update : perl (openSUSE-SU-2026:21411-1)	Nessus	SuSE Local Security Checks	Local	critical
323846	Fedora 43 : perl-Socket (2026-7df6c5acad)	Nessus	Fedora Local Security Checks	Local	critical
322853	Fedora 44 : perl-Socket (2026-91d6cb99f7)	Nessus	Fedora Local Security Checks	Local	critical
321157	Linux Distros Unpatched Vulnerability : CVE-2026-12087	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-12087

critical

Tenable Plugins

Coming Soon

critical

critical

critical

critical

critical

medium

medium

medium

medium

critical

critical

critical

critical

critical

critical

critical