# Perl CPAN vulnerabilities Source: https://junglewise.ai/threats/vendors/perl-cpan Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/perl-cpan.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 13 vulnerabilities in Perl CPAN: 1 in the last 7 days and 3 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-121265, was published on 7 November 2026. 1 vulnerability in the last four weeks, down 50% on the four before (2). 3 technologies have a page of their own. ## Counts - Last 7 days: 1 - Last 30 days: 1 - Last 90 days: 3 - All time: 13 (0 critical, 0 exploited in the wild) ## About Perl CPAN The Comprehensive Perl Archive Network is a repository of software written in the Perl programming language. ## Latest Perl CPAN vulnerabilities - [CVE-2026-121265: SQL::Abstract SQL injection via arrayref column value](https://junglewise.ai/threats/cve-2026-121265-sql-abstract-versions-before-2-000003-for-perl-allow-sql) (info, published 7 Nov 2026) - [CVE-2026-85491: Catalyst::Seal authorization bypass via dispatch memoization](https://junglewise.ai/threats/cve-2026-85491-catalyst-seal-versions-before-0-03-for-perl-allow-one-request-to) (high, CVSS 8.8, published 24 Sep 2026) - [CVE-2026-87082: Perl Net::IDN::Punycode infinite loop and crash in encode_punycode](https://junglewise.ai/threats/cve-2026-87082-net-idn-punycode-versions-before-2-590-for-perl-hang-crash-or) (high, CVSS 7.5, published 22 Sep 2026) - [CVE-2026-16766: Perl Catalyst-View-Wkhtmltopdf shell command injection in render options](https://junglewise.ai/threats/cve-2026-16766-perl-catalyst-view-wkhtmltopdf-shell-command-injection-in-render) (info, CVSS 8.8, published 25 Jul 2026) - [CVE-2026-12205: Perl Crypt::DSA private key recovery via nonce reuse](https://junglewise.ai/threats/cve-2026-12205-perl-crypt-dsa-private-key-recovery-via-nonce-reuse) (info, CVSS 0, published 15 Jun 2026) - [CVE-2026-48962: Perl IO::Compress eval injection in File::GlobMapper](https://junglewise.ai/threats/cve-2026-48962-perl-io-compress-eval-injection-in-file-globmapper) (info, CVSS 0, published 27 May 2026) - [CVE-2026-48961: Perl IO::Compress crash in zipdetails CLI tool](https://junglewise.ai/threats/cve-2026-48961-perl-io-compress-crash-in-zipdetails-cli-tool) (info, CVSS 0, published 27 May 2026) - [CVE-2025-15649: Perl IO::Uncompress::Unzip uncaught exception in DOS date parsing](https://junglewise.ai/threats/cve-2025-15649-perl-io-uncompress-unzip-uncaught-exception-in-dos-date-parsing) (info, CVSS 0, published 27 May 2026) - [CVE-2026-8647: Perl Crypt::ScryptKDF weak PRNG use in random_bytes](https://junglewise.ai/threats/cve-2026-8647-perl-crypt-scryptkdf-weak-prng-use-in-random-bytes) (info, CVSS 3.3, published 26 May 2026) - [CVE-2026-8507: Perl Crypt::OpenSSL::PKCS12 heap overflow in print_attribute](https://junglewise.ai/threats/cve-2026-8507-perl-crypt-openssl-pkcs12-heap-overflow-in-print-attribute) (info, CVSS 9.8, published 17 May 2026) - [CVE-2026-8704: Perl Crypt::DSA insecure file handling via 2-argument open](https://junglewise.ai/threats/cve-2026-8704-perl-crypt-dsa-insecure-file-handling-via-2-argument-open) (info, published 15 May 2026) - [CVE-2026-8700: Perl Crypt::DSA insufficient entropy in seed generation](https://junglewise.ai/threats/cve-2026-8700-perl-crypt-dsa-insufficient-entropy-in-seed-generation) (info, CVSS 0, published 15 May 2026) - [CVE-2026-6659: Crypt::PasswdMD5 weak PRNG in salt generation](https://junglewise.ai/threats/cve-2026-6659-crypt-passwdmd5-weak-prng-in-salt-generation) (high, CVSS 7.5, published 8 May 2026) ## Most severe Perl CPAN vulnerabilities - [CVE-2026-85491: Catalyst::Seal authorization bypass via dispatch memoization](https://junglewise.ai/threats/cve-2026-85491-catalyst-seal-versions-before-0-03-for-perl-allow-one-request-to) (high, CVSS 8.8, published 24 Sep 2026) - [CVE-2026-87082: Perl Net::IDN::Punycode infinite loop and crash in encode_punycode](https://junglewise.ai/threats/cve-2026-87082-net-idn-punycode-versions-before-2-590-for-perl-hang-crash-or) (high, CVSS 7.5, published 22 Sep 2026) - [CVE-2026-6659: Crypt::PasswdMD5 weak PRNG in salt generation](https://junglewise.ai/threats/cve-2026-6659-crypt-passwdmd5-weak-prng-in-salt-generation) (high, CVSS 7.5, published 8 May 2026) - [CVE-2026-8507: Perl Crypt::OpenSSL::PKCS12 heap overflow in print_attribute](https://junglewise.ai/threats/cve-2026-8507-perl-crypt-openssl-pkcs12-heap-overflow-in-print-attribute) (info, CVSS 9.8, published 17 May 2026) - [CVE-2026-16766: Perl Catalyst-View-Wkhtmltopdf shell command injection in render options](https://junglewise.ai/threats/cve-2026-16766-perl-catalyst-view-wkhtmltopdf-shell-command-injection-in-render) (info, CVSS 8.8, published 25 Jul 2026) - [CVE-2026-8647: Perl Crypt::ScryptKDF weak PRNG use in random_bytes](https://junglewise.ai/threats/cve-2026-8647-perl-crypt-scryptkdf-weak-prng-use-in-random-bytes) (info, CVSS 3.3, published 26 May 2026) - [CVE-2026-12205: Perl Crypt::DSA private key recovery via nonce reuse](https://junglewise.ai/threats/cve-2026-12205-perl-crypt-dsa-private-key-recovery-via-nonce-reuse) (info, CVSS 0, published 15 Jun 2026) - [CVE-2026-48962: Perl IO::Compress eval injection in File::GlobMapper](https://junglewise.ai/threats/cve-2026-48962-perl-io-compress-eval-injection-in-file-globmapper) (info, CVSS 0, published 27 May 2026) - [CVE-2026-48961: Perl IO::Compress crash in zipdetails CLI tool](https://junglewise.ai/threats/cve-2026-48961-perl-io-compress-crash-in-zipdetails-cli-tool) (info, CVSS 0, published 27 May 2026) - [CVE-2025-15649: Perl IO::Uncompress::Unzip uncaught exception in DOS date parsing](https://junglewise.ai/threats/cve-2025-15649-perl-io-uncompress-unzip-uncaught-exception-in-dos-date-parsing) (info, CVSS 0, published 27 May 2026) ## Vulnerabilities per week 1 vulnerability in the last four weeks, down 50% on the four before (2). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 2 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Perl CPAN technologies - [Perl CPAN Crypt-Dsa-Perl](https://junglewise.ai/threats/technologies/crypt-dsa): 4 vulnerabilities - [Perl CPAN Crypt::OpenSSL::PKCS12](https://junglewise.ai/threats/technologies/crypt-openssl-pkcs12): 3 vulnerabilities - [Perl CPAN IO::Compress](https://junglewise.ai/threats/technologies/io-compress): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Perl CPAN vulnerabilities", https://junglewise.ai/threats/vendors/perl-cpan, 9 November 2026.