# CVE-2026-57433: Perl Storable integer overflow in SX_HOOK deserialization

Source: https://junglewise.ai/threats/cve-2026-57433-perl-storable-integer-overflow-in-sx-hook-deserialization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-13. Updated: 2026-07-13  
License: CC BY 4.0 with a link back

CVE-2026-57433 · Severity: info · CVSS 0 · Published 2026-07-13

Storable is a Perl module used to convert complex data structures into a format that can be stored or transmitted. A vulnerability in how it handles certain data records can cause the application to crash when processing a specially crafted file or data stream. This results in a denial-of-service, potentially disrupting operations that rely on data deserialization.

Vendors: [Perl Foundation](https://junglewise.ai/threats/vendors/perl-foundation).

## Quick answers

**Is CVE-2026-57433 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57433 being exploited in the wild.

**How severe is CVE-2026-57433?** Informational severity, with a CVSS score of 0, published 13 July 2026.

**Which products and versions are affected?** Perl Foundation Storable before 3.41.

**Is there a fix for CVE-2026-57433?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-57433 attacked?** It is attacked with local access or over the network, in a software library.

**Am I affected by CVE-2026-57433?** Check whether you run Perl Foundation Storable at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer overflow vulnerability exists in the Storable.xs component of the Perl Storable module during the deserialization of SX_HOOK records. The function 'retrieve_hook_common' reads a signed 32-bit item count and adds one to it before calling 'av_extend'. If the count is set to I32_MAX, the addition wraps to a negative value, causing 'av_extend' to trigger a panic and terminate the process. Attackers can exploit this by providing a crafted serialized blob to the 'thaw' or 'retrieve' functions, leading to a denial-of-service (DoS). The issue is resolved in Storable version 3.41.

## Affected products

- Perl Storable before 3.41

## Timeline

- 2026-07-13: disclosed
- 2026-07-13: advisory

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.patch](https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.patch)