Executive brief
Tie::Hash::Regex is a Perl library module that enables hash lookups using regular expressions as keys. Versions before 2.0.0 will crash an application when performing FETCH, EXISTS, or DELETE operations with malformed regex patterns—such as unmatched brackets—supplied as lookup keys. Any application that accepts externally controlled lookup strings could be forced into denial of service by an attacker providing invalid regex syntax.
Technical details
Tie::Hash::Regex's FETCH, EXISTS, and DELETE methods compile lookup keys as regular expressions without proper error handling. When a key is not already stored in the hash, the code attempts to compile the caller's key using a bare qr// operator without an eval guard, causing the entire application to die if the key contains invalid regex syntax (e.g., unmatched brackets, incomplete quantifiers). The vulnerability is triggered whenever an application looks up an externally supplied string that is not a valid regular expression pattern. Version 2.0.0 fixes this by wrapping the regex compilation in an eval block via a _compile() helper function, returning undef for malformed patterns instead of throwing an exception.
Affected products
- CPAN Tie::Hash::Regex before 2.0.0
Timeline
- 2026-08-22: disclosed: CVE-2026-77781 published
- 2026-08-21: patched: Version 2.0.0 released with fix