Executive brief
Storable is a Perl module used to convert complex data structures into a format that can be stored or transmitted. A vulnerability in how it handles certain data records can cause the application to crash when processing a specially crafted file or data stream. This results in a denial-of-service, potentially disrupting operations that rely on data deserialization.
Technical details
An integer overflow vulnerability exists in the Storable.xs component of the Perl Storable module during the deserialization of SX_HOOK records. The function 'retrieve_hook_common' reads a signed 32-bit item count and adds one to it before calling 'av_extend'. If the count is set to I32_MAX, the addition wraps to a negative value, causing 'av_extend' to trigger a panic and terminate the process. Attackers can exploit this by providing a crafted serialized blob to the 'thaw' or 'retrieve' functions, leading to a denial-of-service (DoS). The issue is resolved in Storable version 3.41.
Affected products
- Perl Storable before 3.41
Timeline
- 2026-07-13: disclosed
- 2026-07-13: advisory