Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys
Summary
| CVE | CVE-2026-77781 |
|---|---|
| State | PUBLISHED |
| Assigner | CPANSec |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-22 00:16:46 UTC |
| Updated | 2026-08-27 20:18:39 UTC |
| Description | Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys. The FETCH, EXISTS and DELETE methods throw an exception when on malformed regular expressions. Each method falls back to a regex match when the key is not already stored in the hash, compiling the caller's key with a bare qr// and no eval guard. A key that is not a valid regular expression pattern, such as a single unmatched bracket, dies. An application that looks up externally supplied strings in a tied hash will die on an invalid key. |
Risk And Classification
Primary CVSS: v3.1 7.5 HIGH from ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.002380000 probability, percentile 0.146010000 (date 2026-08-27)
Problem Types: CWE-248 | CWE-248 CWE-248 Uncaught Exception
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | ADP | DECLARED | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 3.1 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
NoneIntegrity
NoneAvailability
HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
There are no known software configurations currently associated with this CVE in NVD or the CVE Program record.
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| metacpan.org/release/DAVECROSS/Tie-Hash-Regex-2.0.0/source/Changes | 9b29abf9-4ab0-4765-b253-1875cd9b441e | metacpan.org | |
| github.com/davorg-cpan/tie-hash-regex/commit/4239732cb76233543e2ded8ff5e... | 9b29abf9-4ab0-4765-b253-1875cd9b441e | github.com | |
| www.openwall.com/lists/oss-security/2026/08/22/2 | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
Solutions
CNA: Upgrade to Tie::Hash::Regex version 2.0.0 or later.
Workarounds
CNA: For deployments that cannot be upgraded, ensure that calls to check the existence of keys, fetch values from keys or delete keys are wrapped in an eval block.
There are currently no legacy QID mappings associated with this CVE.