Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.

Multiple Vulnerabilities in Perl

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-672780 advisory.

    - Fixes: CVE-2026-13221 - Don't create a trie that would overflow
    - Fix CVE-2025-40909 - Clone dirhandles without fchdir
    - Fix CVE-2023-47038
    - Fix CVE-2026-9538: Denial of Service via crafted tar header with large entry size       Resolves: RHEL-191908
    - Fix CVE-2026-42496: validate symlink and hardlink targets in secure       extract mode       Resolves: RHEL-181655
    - Fix CVE-2021-36770 - mitigate @INC pollution when loading ConfigLocal
    - Resolves arbitrary code execution via attacker-controlled output glob (CVE-2026-48962)       Resolves: RHEL-180421

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:67155 advisory.

    * perl: Perl: Incorrect regular expression processing via large regular expressions (CVE-2026-13221)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-671620 advisory.

    [5.26.3]
    - Backport patches from CentOS
    - Fix Time-Local tests to pass after year 2019 (bug #1807120)

    [4:5.26.3-423.1]
    - Fix CVE-2026-13221 - Don't create a regex trie that would overflow

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:67156 advisory.

    * perl: Perl: Incorrect regular expression processing via large regular expressions (CVE-2026-13221)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:67278 advisory.

    * perl: Perl: Incorrect regular expression processing via large regular expressions (CVE-2026-13221)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:67162 advisory.

    * perl: Perl: Incorrect regular expression processing via large regular expressions (CVE-2026-13221)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:67155 advisory.

    * perl: Perl: Incorrect regular expression processing via large regular expressions (CVE-2026-13221)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:67156 advisory.

    * perl: Perl: Incorrect regular expression processing via large regular expressions (CVE-2026-13221)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1838:25 advisory.

    * perl: Perl: Incorrect regular expression processing via large regular expressions (CVE-2026-13221)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:67162 advisory.

    * perl: Perl: Incorrect regular expression processing via large regular expressions (CVE-2026-13221)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1831:24 advisory.

    * perl: Perl: Incorrect regular expression processing via large regular expressions (CVE-2026-13221)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-671550 advisory.

    - Fixes: CVE-2026-13221 - Don't create a trie that would overflow

    * Thu Jul 10 2025 Jitka Plesnikova <jplesnik@redhat.com>

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:67278 advisory.

    * perl: Perl: Incorrect regular expression processing via large regular expressions (CVE-2026-13221)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-671560 advisory.

    - Fixes: CVE-2026-13221 - regcomp_study: Don't create a trie that would       overflow
    - Fixes: CVE-2025-40909 - Clone dirhandles without fchdir

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67278 advisory.

    Perl is a high-level programming language that is commonly used for system administration utilities and     web programming.

    Security Fix(es):

    * perl: Perl: Incorrect regular expression processing via large regular expressions (CVE-2026-13221)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67156 advisory.

    Perl is a high-level programming language that is commonly used for system administration utilities and     web programming.

    Security Fix(es):

    * perl: Perl: Incorrect regular expression processing via large regular expressions (CVE-2026-13221)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67155 advisory.

    Perl is a high-level programming language that is commonly used for system administration utilities and     web programming.

    Security Fix(es):

    * perl: Perl: Incorrect regular expression processing via large regular expressions (CVE-2026-13221)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67162 advisory.

    Perl is a high-level programming language that is commonly used for system administration utilities and     web programming.

    Security Fix(es):

    * perl: Perl: Incorrect regular expression processing via large regular expressions (CVE-2026-13221)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the perl package has been released.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22847-1 advisory.

    - CVE-2025-15649: `IO:Uncompress:Unzip` propagates uncaught exception when parsing zip header with     malformed DOS date       (bsc#1266361).
    - CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on     32-bit builds       (bsc#1266304).
    - CVE-2026-12087: `Socket`'s `pack_ip_mreq_source()` can copy adjacent heap memory into the returned     packed structure       (bsc#1268349).
    - CVE-2026-57432: an integer overflow in `S_measure_struct` leads to an out-of-bounds heap read in `pack`     and `unpack`       (bsc#1271372).
    - CVE-2026-13221: regex trie branch-count overflow leads to silent false-positive/negative pattern     matching       (bsc#1271386).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21411-1 advisory.

    - CVE-2025-15649: `IO:Uncompress:Unzip` propagates uncaught exception when parsing zip header with     malformed DOS date       (bsc#1266361).
    - CVE-2026-8376: heap buffer overflow when compiling regular expressions with a repeated fixed string on     32-bit builds       (bsc#1266304).
    - CVE-2026-12087: `Socket`'s `pack_ip_mreq_source()` can copy adjacent heap memory into the returned     packed structure       (bsc#1268349).
    - CVE-2026-57432: an integer overflow in `S_measure_struct` leads to an out-of-bounds heap read in `pack`     and `unpack`       (bsc#1271372).
    - CVE-2026-13221: regex trie branch-count overflow leads to silent false-positive/negative pattern     matching       (bsc#1271386).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce     silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches     is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta     between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535     overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern     of this shape produces false positive matches (matching strings it should not) and false negative matches     (failing to match strings it should). When such a pattern gates an access or filtering decision, the     result is wrong. (CVE-2026-13221)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
346254	Oracle Linux 8 : ELSA-2026-67278-0: / perl:5.32 (ELSA-2026-672780)	Nessus	Oracle Linux Local Security Checks	Local	critical
346032	RockyLinux 9 : perl (RLSA-2026:67155)	Nessus	Rocky Linux Local Security Checks	Local	critical
345989	Oracle Linux 8 : ELSA-2026-67162-0: / perl (ELSA-2026-671620)	Nessus	Oracle Linux Local Security Checks	Local	critical
345940	AlmaLinux 10 : perl (ALSA-2026:67156)	Nessus	Alma Linux Local Security Checks	Local	critical
345938	AlmaLinux 8 : perl:5.32 (ALSA-2026:67278)	Nessus	Alma Linux Local Security Checks	Local	critical
345937	AlmaLinux 8 : perl (ALSA-2026:67162)	Nessus	Alma Linux Local Security Checks	Local	critical
345930	AlmaLinux 9 : perl (ALSA-2026:67155)	Nessus	Alma Linux Local Security Checks	Local	critical
345923	RockyLinux 10 : perl (RLSA-2026:67156)	Nessus	Rocky Linux Local Security Checks	Local	critical
345887	MiracleLinux 9 : perl-5.32.1-484.el9_8 (AXSA:2026-1838:25)	Nessus	Miracle Linux Local Security Checks	Local	critical
345865	RockyLinux 8 : perl (RLSA-2026:67162)	Nessus	Rocky Linux Local Security Checks	Local	critical
345849	MiracleLinux 8 : perl-5.26.3-423.el8_10.1 (AXSA:2026-1831:24)	Nessus	Miracle Linux Local Security Checks	Local	critical
345746	Oracle Linux 9 : ELSA-2026-67155-0: / perl (ELSA-2026-671550)	Nessus	Oracle Linux Local Security Checks	Local	critical
345731	RockyLinux 8 : perl:5.32 (RLSA-2026:67278)	Nessus	Rocky Linux Local Security Checks	Local	critical
345690	Oracle Linux 10 : ELSA-2026-67156-0: / perl (ELSA-2026-671560)	Nessus	Oracle Linux Local Security Checks	Local	critical
345610	RHEL 8 : perl:5.32 (RHSA-2026:67278)	Nessus	Red Hat Local Security Checks	Local	critical
345605	RHEL 10 : perl (RHSA-2026:67156)	Nessus	Red Hat Local Security Checks	Local	critical
345603	RHEL 9 : perl (RHSA-2026:67155)	Nessus	Red Hat Local Security Checks	Local	critical
345601	RHEL 8 : perl (RHSA-2026:67162)	Nessus	Red Hat Local Security Checks	Local	critical
333513	Photon OS 5.0: Perl PHSA-2026-5.0-92-0946	Nessus	PhotonOS Local Security Checks	Local	critical
330290	SUSE SLES16 Security Update : perl (SUSE-SU-2026:22847-1)	Nessus	SuSE Local Security Checks	Local	critical
329512	openSUSE 16 Security Update : perl (openSUSE-SU-2026:21411-1)	Nessus	SuSE Local Security Checks	Local	critical
326561	Linux Distros Unpatched Vulnerability : CVE-2026-13221	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2026-13221

critical

Tenable Plugins

Coming Soon

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical