Amazon Linux 2 (EOS) Security Advisory: ALAS2-2026-3997
Advisory Released Date: 2026-10-12
Advisory Updated Date: 2026-10-12
Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.
When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.
A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong. (CVE-2026-13221)
Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.
S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.
A template derived from untrusted input can read heap memory past the buffer and return it to the caller. (CVE-2026-57432)
Affected Packages:
perl
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update perl or yum update --advisory ALAS2-2026-3997 to update your system.
aarch64:
perl-5.16.3-299.amzn2.0.5.aarch64
perl-libs-5.16.3-299.amzn2.0.5.aarch64
perl-devel-5.16.3-299.amzn2.0.5.aarch64
perl-macros-5.16.3-299.amzn2.0.5.aarch64
perl-tests-5.16.3-299.amzn2.0.5.aarch64
perl-Time-Piece-1.20.1-299.amzn2.0.5.aarch64
perl-core-5.16.3-299.amzn2.0.5.aarch64
perl-debuginfo-5.16.3-299.amzn2.0.5.aarch64
i686:
perl-5.16.3-299.amzn2.0.5.i686
perl-libs-5.16.3-299.amzn2.0.5.i686
perl-devel-5.16.3-299.amzn2.0.5.i686
perl-macros-5.16.3-299.amzn2.0.5.i686
perl-tests-5.16.3-299.amzn2.0.5.i686
perl-Time-Piece-1.20.1-299.amzn2.0.5.i686
perl-core-5.16.3-299.amzn2.0.5.i686
perl-debuginfo-5.16.3-299.amzn2.0.5.i686
noarch:
perl-CPAN-1.9800-299.amzn2.0.5.noarch
perl-ExtUtils-CBuilder-0.28.2.6-299.amzn2.0.5.noarch
perl-ExtUtils-Embed-1.30-299.amzn2.0.5.noarch
perl-ExtUtils-Install-1.58-299.amzn2.0.5.noarch
perl-IO-Zlib-1.10-299.amzn2.0.5.noarch
perl-Locale-Maketext-Simple-0.21-299.amzn2.0.5.noarch
perl-Module-CoreList-2.76.02-299.amzn2.0.5.noarch
perl-Module-Loaded-0.08-299.amzn2.0.5.noarch
perl-Object-Accessor-0.42-299.amzn2.0.5.noarch
perl-Package-Constants-0.02-299.amzn2.0.5.noarch
perl-Pod-Escapes-1.04-299.amzn2.0.5.noarch
src:
perl-5.16.3-299.amzn2.0.5.src
x86_64:
perl-5.16.3-299.amzn2.0.5.x86_64
perl-libs-5.16.3-299.amzn2.0.5.x86_64
perl-devel-5.16.3-299.amzn2.0.5.x86_64
perl-macros-5.16.3-299.amzn2.0.5.x86_64
perl-tests-5.16.3-299.amzn2.0.5.x86_64
perl-Time-Piece-1.20.1-299.amzn2.0.5.x86_64
perl-core-5.16.3-299.amzn2.0.5.x86_64
perl-debuginfo-5.16.3-299.amzn2.0.5.x86_64