Alpine: miniperl, multiple perl packages: security update to 5.42.3-r0

critical Tenable Cloud Security Plugin ID 478288

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap
buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.
Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather
than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l
could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end
of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build
triggers a heap buffer overflow at compile time. (CVE-2026-8376)

- IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header
with malformed DOS date. _dosToUnixTime() decodes the local-file-header last-modification date field and
calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range
month, day, or hour causes timelocal() to die. The exception propagates out of
IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError. (CVE-2025-15649)

- HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field
header values. The unvalidated inputs are the method and URI in the request line, the URL host that
becomes the `Host:` header, and HTTP/1.1 control data field values. An attacker who controls one of these
inputs, for example a user supplied URL passed to a webhook or URL fetch endpoint, can inject additional
headers and smuggle requests to the upstream server. (CVE-2026-7010)

- HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.
When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and
`_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking
whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`,
`Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names,
across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in
plaintext on the wire. The HTTP::Tiny POD note that "Authorization headers will not be included in a
redirected request" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by
the caller. (CVE-2026-7017)

Solution

Update the miniperl library and its related packages to version 5.42.3-r0 or later.

Plugin Details

Severity: Critical

ID: 478288

Version: Revision 1.2

Type: Local

Family: Alpine Linux Local Security Checks

Published: 11/4/2026

Updated: 11/4/2026

Supported Sensors: Agentless Assessment

Risk Information

VPR

Risk Factor: High

Score: 7.1

Percentile: 98.36

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-8376

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 5/11/2026

Reference Information

CVE: CVE-2025-15649, CVE-2026-12087, CVE-2026-42496, CVE-2026-42497, CVE-2026-48959, CVE-2026-48961, CVE-2026-48962, CVE-2026-57432, CVE-2026-57433, CVE-2026-7010, CVE-2026-7017, CVE-2026-8376, CVE-2026-9538

IAVA: 2026-A-0618, 2026-A-0696-S

Detections

Analytics