Is CVE-2026-57433 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57433 being exploited in the wild.

How severe is CVE-2026-57433?

Informational severity, with a CVSS score of 0, published 13 July 2026.

Which products and versions are affected?

Perl Foundation Storable before 3.41.

Is there a fix for CVE-2026-57433?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-57433 attacked?

It is attacked with local access or over the network, in a software library.

Am I affected by CVE-2026-57433?

Check whether you run Perl Foundation Storable at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57433: Perl Storable integer overflow in SX_HOOK deserialization

CVE-2026-57433 · Severity: info · CVSS 0 · Published 2026-07-13

Storable is a Perl module used to convert complex data structures into a format that can be stored or transmitted. A vulnerability in how it handles certain data records can cause the application to crash when processing a specially crafted file or data stream. This results in a denial-of-service, potentially disrupting operations that rely on data deserialization.

Vendors: Perl Foundation.

Quick answers

Is CVE-2026-57433 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57433 being exploited in the wild.
How severe is CVE-2026-57433?: Informational severity, with a CVSS score of 0, published 13 July 2026.
Which products and versions are affected?: Perl Foundation Storable before 3.41.
Is there a fix for CVE-2026-57433?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-57433 attacked?: It is attacked with local access or over the network, in a software library.
Am I affected by CVE-2026-57433?: Check whether you run Perl Foundation Storable at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer overflow vulnerability exists in the Storable.xs component of the Perl Storable module during the deserialization of SX_HOOK records. The function 'retrieve_hook_common' reads a signed 32-bit item count and adds one to it before calling 'av_extend'. If the count is set to I32_MAX, the addition wraps to a negative value, causing 'av_extend' to trigger a panic and terminate the process. Attackers can exploit this by providing a crafted serialized blob to the 'thaw' or 'retrieve' functions, leading to a denial-of-service (DoS). The issue is resolved in Storable version 3.41.

Affected products

Perl Storable before 3.41

Timeline

2026-07-13: disclosed
2026-07-13: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.