Executive brief
Sereal::Decoder is a high-performance data serialization library for Perl. A vulnerability in how it handles certain data tags allows a malicious actor to provide specially crafted input that causes the decoder to read memory outside of its intended buffer. This could lead to the exposure of sensitive information from the application's memory or cause the service to crash.
Technical details
An out-of-bounds read vulnerability exists in Sereal::Decoder's srl_read_object() and srl_read_hash() functions within srl_decoder.c. The issue stems from the processing of the COPY tag, which acts as a back-reference. When a COPY tag points to a target byte that matches the SHORT_BINARY pattern, the decoder fails to verify that the resulting read remains within the bounds of the input buffer relative to the COPY tag's offset. An attacker can manipulate the COPY offset to point inside a previously decoded value, causing the decoder to interpret arbitrary bytes as a SHORT_BINARY tag and read up to 31 subsequent bytes from the heap as a class name or hash key. This can result in information disclosure or a denial-of-service condition. The vulnerability is addressed in version 5.005.
Affected products
- Sereal Sereal::Decoder < 5.005
Timeline
- 2026-05-19: patched: Fix committed to repository.
- 2026-05-31: disclosed: CVE-2026-8796 published.