# CPAN vulnerabilities

Source: https://junglewise.ai/threats/vendors/cpan  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/vendors/cpan.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 56 vulnerabilities in CPAN: 0 in the last 7 days and 41 in the last 90 days, 6 of them critical and 0 exploited in the wild. The most recent, CVE-2026-121008, was published on 4 November 2026. 24 vulnerabilities in the last four weeks, up 71% on the four before (14). 0 critical against 4. 5 technologies have a page of their own.

## Counts

- Last 7 days: 0
- Last 30 days: 24
- Last 90 days: 41
- All time: 56 (6 critical, 0 exploited in the wild)

## About CPAN

The Comprehensive Perl Archive Network is a central repository for Perl software and documentation.

## Latest CPAN vulnerabilities

- [CVE-2026-121008: SQL::Abstract::Tree cross-site scripting in HTML profile](https://junglewise.ai/threats/cve-2026-121008-sql-abstract-tree-versions-before-2-000001-04-for-perl-allow) (info, published 4 Nov 2026)
- [CVE-2026-115943: Spreadsheet::XLSX remote code execution via format condition eval](https://junglewise.ai/threats/cve-2026-115943-spreadsheet-xlsx-versions-before-0-19-for-perl-allow-code) (info, published 29 Oct 2026)
- [CVE-2026-116285: HTTP::Body regex denial of service in chunked request parsing](https://junglewise.ai/threats/cve-2026-116285-http-body-versions-before-1-23-01-for-perl-allow-cpu-exhaustion) (info, published 28 Oct 2026)
- [CVE-2026-116273: MIME::Parser memory exhaustion via unlimited message parts](https://junglewise.ai/threats/cve-2026-116273-mime-parser-versions-before-5-521-for-perl-set-no-limit-on-the) (info, published 28 Oct 2026)
- [CVE-2026-116270: MIME::Words memory exhaustion in decode_mimewords](https://junglewise.ai/threats/cve-2026-116270-mime-words-versions-before-5-521-for-perl-allow-memory) (info, published 28 Oct 2026)
- [CVE-2026-116264: MIME::tools parameter parsing information disclosure](https://junglewise.ai/threats/cve-2026-116264-mime-field-paramval-versions-before-5-521-for-perl-allow-one) (info, published 28 Oct 2026)
- [CVE-2026-116134: HTTP::Body memory exhaustion in multipart header parsing](https://junglewise.ai/threats/cve-2026-116134-http-body-versions-before-1-23-01-for-perl-allow-memory) (info, published 28 Oct 2026)
- [CVE-2026-115825: HTTP::Server::PSGI memory exhaustion via large Content-Length](https://junglewise.ai/threats/cve-2026-115825-http-server-psgi-versions-before-1-0056-for-perl-allow-a-single) (info, published 25 Oct 2026)
- [CVE-2026-113877: HTTP::Headers::ActionPack ReDoS in Accept-Language matching](https://junglewise.ai/threats/cve-2026-113877-http-headers-actionpack-versions-before-0-10-for-perl-allow-cpu) (info, published 23 Oct 2026)
- [CVE-2026-94423: Net::LibSSH server verification missing in connect](https://junglewise.ai/threats/cve-2026-94423-net-libssh-versions-before-0-004-for-perl-authenticate-to-an) (info, published 21 Oct 2026)
- [CVE-2026-111946: Plack::Middleware::ETag inode disclosure in default ETag header](https://junglewise.ai/threats/cve-2026-111946-plack-middleware-etag-versions-from-0-04-before-0-06-for-perl) (info, published 19 Oct 2026)
- [CVE-2026-110686: Cpanel::JSON::XS use-after-free in filter callbacks](https://junglewise.ai/threats/cve-2026-110686-cpanel-json-xs-versions-before-4-80-for-perl-use-freed-filter) (info, published 19 Oct 2026)
- [CVE-2026-110684: Cpanel::JSON::XS memory leak in encode_stringify](https://junglewise.ai/threats/cve-2026-110684-cpanel-json-xs-versions-from-3-0202-before-4-80-for-perl-leak) (info, published 19 Oct 2026)
- [CVE-2026-110681: Cpanel::JSON::XS use-after-free in ithread parser objects](https://junglewise.ai/threats/cve-2026-110681-cpanel-json-xs-versions-before-4-80-for-perl-use-the-parent) (info, published 19 Oct 2026)
- [CVE-2026-110680: Cpanel::JSON::XS out of bounds write in canonical hash encoding](https://junglewise.ai/threats/cve-2026-110680-cpanel-json-xs-versions-from-4-20-before-4-80-for-perl-write-out) (info, published 19 Oct 2026)
- [CVE-2026-110676: Cpanel::JSON::XS memory exhaustion in exponent encoding](https://junglewise.ai/threats/cve-2026-110676-cpanel-json-xs-versions-before-4-80-for-perl-allow-memory) (info, published 19 Oct 2026)
- [CVE-2026-78497: JQ::Lite Perl code execution via regex eval](https://junglewise.ai/threats/cve-2026-78497-jq-lite-versions-before-2-51-for-perl-execute-perl-code-embedded) (info, published 18 Oct 2026)
- [CVE-2026-110759: Text::CSV_XS incorrect byte returned for empty field with trailing CR](https://junglewise.ai/threats/cve-2026-110759-text-csv-xs-versions-before-1-65-for-perl-return-a-0xff-byte) (info, published 16 Oct 2026)
- [CVE-2026-110758: Text::CSV_XS buffer over-read in strip_trail_whitespace](https://junglewise.ai/threats/cve-2026-110758-text-csv-xs-versions-before-1-65-for-perl-read-before-the-start) (info, published 16 Oct 2026)
- [CVE-2026-110757: Text::CSV_XS record splitting via unquoted numeric strings](https://junglewise.ai/threats/cve-2026-110757-text-csv-xs-versions-before-1-65-for-perl-allow-record-splitting) (info, published 16 Oct 2026)
- [CVE-2026-110756: Text::CSV_XS data corruption in print with UTF-8 and invalid bytes](https://junglewise.ai/threats/cve-2026-110756-text-csv-xs-versions-before-1-65-for-perl-drop-the-end-of-a) (info, published 16 Oct 2026)
- [CVE-2026-110755: Text::CSV_XS quadratic CPU use with CR-only input](https://junglewise.ai/threats/cve-2026-110755-text-csv-xs-versions-before-1-65-for-perl-allow-quadratic-cpu) (info, published 16 Oct 2026)
- [CVE-2026-110753: Text::CSV_XS use-after-free in bind_columns with skip_empty_rows](https://junglewise.ai/threats/cve-2026-110753-text-csv-xs-versions-from-1-46-before-1-65-for-perl-have-a-use) (info, published 16 Oct 2026)
- [CVE-2026-110752: Text::CSV_XS memory exhaustion in RFC 7111 fragment parsing](https://junglewise.ai/threats/cve-2026-110752-text-csv-xs-versions-before-1-65-for-perl-allow-memory) (info, published 16 Oct 2026)
- [CVE-2026-107794: ExtUtils::Typemaps::STL::List memory exhaustion via av_extend integer underflow](https://junglewise.ai/threats/cve-2026-107794-extutils-typemaps-stl-list-versions-before-1-07-for-perl) (info, published 10 Oct 2026)

## Most severe CPAN vulnerabilities

- [CVE-2026-78183: DBD::Pg heap out-of-bounds write in quote_float](https://junglewise.ai/threats/cve-2026-78183-dbd-pg-heap-out-of-bounds-write-in-quote-float) (critical, CVSS 9.8, published 23 Aug 2026)
- [CVE-2006-10003: CPAN XML::Parser heap buffer overflow in st_serial_stack](https://junglewise.ai/threats/cve-2006-10003-cpan-xml-parser-heap-buffer-overflow-in-st-serial-stack) (critical, CVSS 9.8, published 19 Mar 2026)
- [CVE-2016-15059: Net::IDN::Punycode heap buffer overflow in encode_punycode](https://junglewise.ai/threats/cve-2016-15059-net-idn-punycode-versions-before-2-301-for-perl-allow-a-heap) (critical, CVSS 9.8, published 22 Sep 2026)
- [CVE-2026-97230: IO::Socket::SSL::SelfCertificate malware code execution via obfuscated URL](https://junglewise.ai/threats/cve-2026-97230-io-socket-ssl-selfcertificate-versions-1-00-for-perl-contains) (critical, CVSS 9.8, published 24 Sep 2026)
- [CVE-2026-87078: Net::IDN::Punycode memory leak in decode_punycode](https://junglewise.ai/threats/cve-2026-87078-net-idn-punycode-versions-from-2-302-before-2-590-for-perl-leak) (critical, CVSS 9.1, published 22 Sep 2026)
- [CVE-2026-87080: Net::IDN::Punycode::PP truncated label decoding vulnerability](https://junglewise.ai/threats/cve-2026-87080-net-idn-punycode-pp-versions-before-2-590-for-perl-decode-a) (critical, CVSS 9.1, published 22 Sep 2026)
- [CVE-2026-74766: Net::IDN::Punycode heap use-after-free in decode_punycode](https://junglewise.ai/threats/cve-2026-74766-net-idn-punycode-versions-from-2-301-before-2-590-for-perl-allow) (high, CVSS 8.4, published 22 Sep 2026)
- [CVE-2026-95831: Crypt::SelfCertificate malware in Perl module](https://junglewise.ai/threats/cve-2026-95831-crypt-selfcertificate-versions-from-1-01-through-1-05-for-perl) (high, CVSS 7.8, published 22 Sep 2026)
- [CVE-2026-87081: Net::IDN::UTS46 CPU exhaustion via quadratic punycode encoding](https://junglewise.ai/threats/cve-2026-87081-net-idn-uts46-versions-before-2-590-for-perl-allow-cpu-exhaustion) (high, CVSS 7.5, published 22 Sep 2026)
- [CVE-2026-87079: Net::IDN::Punycode CPU exhaustion via quadratic insertion cost](https://junglewise.ai/threats/cve-2026-87079-net-idn-punycode-versions-before-2-590-for-perl-allow-cpu) (high, CVSS 7.5, published 22 Sep 2026)

## Vulnerabilities per week

24 vulnerabilities in the last four weeks, up 71% on the four before (14). 0 critical against 4.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 2 | 1 | 0 |
| 24 Aug 2026 | 0 | 0 | 0 |
| 31 Aug 2026 | 1 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 0 | 0 | 0 |
| 21 Sep 2026 | 9 | 4 | 0 |
| 28 Sep 2026 | 2 | 0 | 0 |
| 5 Oct 2026 | 3 | 0 | 0 |
| 12 Oct 2026 | 8 | 0 | 0 |
| 19 Oct 2026 | 9 | 0 | 0 |
| 26 Oct 2026 | 6 | 0 | 0 |
| 2 Nov 2026 | 1 | 0 | 0 |
| 9 Nov 2026 | 0 | 0 | 0 |

## CPAN technologies

- [CPAN Text::CSV XS](https://junglewise.ai/threats/technologies/cpan-text-csv-xs): 7 vulnerabilities
- [Cpanel::JSON::XS](https://junglewise.ai/threats/technologies/cpanel-json-xs): 7 vulnerabilities
- [CPAN Net::IDN::Punycode](https://junglewise.ai/threats/technologies/net-idn-punycode): 5 vulnerabilities
- [CPAN Net::CIDR::Lite](https://junglewise.ai/threats/technologies/net-cidr-lite): 3 vulnerabilities
- [CPAN YAML-Syck](https://junglewise.ai/threats/technologies/yaml-syck): 3 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "CPAN vulnerabilities", https://junglewise.ai/threats/vendors/cpan, 12 November 2026.