# Perl vulnerabilities

Source: https://junglewise.ai/threats/vendors/perl  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 11 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/vendors/perl.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 43 vulnerabilities in Perl: 2 in the last 7 days and 41 in the last 90 days, 3 of them critical and 1 exploited in the wild. The most recent, CVE-2026-120212, was published on 10 November 2026. 34 vulnerabilities in the last four weeks, up 750% on the four before (4). 0 critical against 1. 5 technologies have a page of their own.

## Counts

- Last 7 days: 2
- Last 30 days: 35
- Last 90 days: 41
- All time: 43 (3 critical, 1 exploited in the wild)

## About Perl

The development community responsible for the Perl programming language and its core ecosystem.

## Latest Perl vulnerabilities

- [CVE-2026-120212: Web::Simple HTML::Tags single-quoted attribute XSS](https://junglewise.ai/threats/cve-2026-120212-web-simple-versions-before-0-037-for-perl-do-not-escape-single) (info, published 10 Nov 2026)
- [CVE-2026-121006: HTTP::Body Perl trailer parsing quadratic time complexity denial of service](https://junglewise.ai/threats/cve-2026-121006-http-body-versions-before-1-24-02-for-perl-parse-the-trailer-in) (info, published 6 Nov 2026)
- [CVE-2026-120651: Perl CGI infinite loop in read_postdata_putdata with disabled uploads](https://junglewise.ai/threats/cve-2026-120651-cgi-versions-before-5-00-for-perl-allow-an-infinite-loop-on-a) (info, published 4 Nov 2026)
- [CVE-2026-120650: CGI for Perl resource exhaustion via missing upload limits](https://junglewise.ai/threats/cve-2026-120650-cgi-versions-before-5-00-for-perl-allow-memory-cpu-and-disk) (info, published 4 Nov 2026)
- [CVE-2026-120648: Perl CGI HTML injection via comment delimiter](https://junglewise.ai/threats/cve-2026-120648-cgi-versions-before-5-00-for-perl-allow-html-injection-via-text) (info, published 4 Nov 2026)
- [CVE-2026-120647: Perl CGI header attachment parameter injection](https://junglewise.ai/threats/cve-2026-120647-cgi-versions-before-5-00-for-perl-allow-content-disposition) (info, published 4 Nov 2026)
- [CVE-2026-120646: CGI Perl denial of service via symbolic reference in uploadInfo](https://junglewise.ai/threats/cve-2026-120646-cgi-versions-from-4-71-before-5-00-for-perl-allow-denial-of) (info, published 4 Nov 2026)
- [CVE-2026-120644: CGI::Cookie cookie attribute injection via unvalidated path, domain, expires](https://junglewise.ai/threats/cve-2026-120644-cgi-cookie-versions-before-5-00-for-perl-allow-cookie-attribute) (info, published 4 Nov 2026)
- [CVE-2026-120643: Perl CGI cross-site scripting in url and self_url](https://junglewise.ai/threats/cve-2026-120643-cgi-versions-from-4-62-before-5-00-for-perl-allow-cross-site) (info, published 4 Nov 2026)
- [CVE-2026-120642: Perl CGI taint bypass via request-derived values](https://junglewise.ai/threats/cve-2026-120642-cgi-versions-before-5-00-for-perl-return-request-derived-values) (info, published 4 Nov 2026)
- [CVE-2026-120640: CGI.pm parameter injection via reserved param names](https://junglewise.ai/threats/cve-2026-120640-cgi-versions-before-5-00-for-perl-allow-the-postdata-putdata) (info, published 4 Nov 2026)
- [CVE-2026-120639: CGI HTTP header injection via entity decoding in header values](https://junglewise.ai/threats/cve-2026-120639-cgi-versions-before-5-00-for-perl-allow-http-header-injection) (info, published 4 Nov 2026)
- [CVE-2026-120638: CGI for Perl open redirect via HTML entity decoding in URL](https://junglewise.ai/threats/cve-2026-120638-cgi-versions-before-5-00-for-perl-allow-open-redirects-via-html) (info, published 4 Nov 2026)
- [CVE-2026-120637: Perl CGI parameter injection via unrecognized REQUEST_METHOD](https://junglewise.ai/threats/cve-2026-120637-cgi-versions-before-5-00-for-perl-take-request-parameters-from) (info, published 4 Nov 2026)
- [CVE-2026-120636: Perl CGI open redirect and script injection via REQUEST_URI](https://junglewise.ai/threats/cve-2026-120636-cgi-versions-before-5-00-for-perl-allow-open-redirects-and) (info, published 4 Nov 2026)
- [CVE-2026-120635: Perl CGI multipart form field smuggling past proxies and WAFs](https://junglewise.ai/threats/cve-2026-120635-cgi-versions-before-5-00-for-perl-allow-form-fields-to-be) (info, published 4 Nov 2026)
- [CVE-2026-120634: Perl CGI::Carp information disclosure in persistent environments](https://junglewise.ai/threats/cve-2026-120634-cgi-carp-versions-before-5-00-for-perl-leak-warnings-across) (info, published 4 Nov 2026)
- [CVE-2026-120633: CGI for Perl improper validation of X-Forwarded-Host](https://junglewise.ai/threats/cve-2026-120633-cgi-versions-before-5-00-for-perl-trust-the-client-x-forwarded) (info, published 4 Nov 2026)
- [CVE-2026-120632: CGI module for Perl ReDoS via multipart/related Content-Type](https://junglewise.ai/threats/cve-2026-120632-cgi-versions-before-5-00-for-perl-allow-cpu-exhaustion-via-a) (info, published 4 Nov 2026)
- [CVE-2026-120631: Perl CGI::Cookie regex injection in expires parsing](https://junglewise.ai/threats/cve-2026-120631-cgi-cookie-versions-from-4-67-before-5-00-for-perl-allow-denial) (info, published 4 Nov 2026)
- [CVE-2026-13575: HTTP::Session memcached command injection in Store::CHI](https://junglewise.ai/threats/cve-2026-13575-http-session-versions-before-0-54-for-perl-allow-memcached) (info, published 1 Nov 2026)
- [CVE-2026-115946: XS::libbrotli out-of-bounds write in bundled brotli decoder](https://junglewise.ai/threats/cve-2026-115946-xs-libbrotli-versions-before-1-2-1-0-for-perl-bundle-a-brotli) (info, published 1 Nov 2026)
- [CVE-2026-117501: HTTP::Body unbounded memory buffering in chunked request parsing](https://junglewise.ai/threats/cve-2026-117501-http-body-versions-before-1-24-01-for-perl-allow-memory) (info, published 28 Oct 2026)
- [CVE-2026-117500: HTTP::Body regex backtracking DoS in multipart filename parsing](https://junglewise.ai/threats/cve-2026-117500-http-body-versions-before-1-24-01-for-perl-allow-cpu-exhaustion) (info, published 28 Oct 2026)
- [CVE-2026-116272: MIME-tools MIME::Parser duplicate boundary detection bypass with comments](https://junglewise.ai/threats/cve-2026-116272-mime-field-paramval-versions-before-5-521-for-perl-do-not-flag-a) (info, published 28 Oct 2026)

## Most severe Perl vulnerabilities

- [CVE-2021-22204: ExifTool Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2021-22204-exiftool-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 7.8, published 17 Nov 2021)
- [CVE-2026-93012: Perl Email::Sender::Transport::Sendmail command injection on Windows](https://junglewise.ai/threats/cve-2026-93012-email-sender-transport-sendmail-versions-before-2-602-for-perl) (critical, CVSS 9.8, published 21 Sep 2026)
- [CVE-2026-86219: Authen::SASL::Perl::DIGEST_MD5 nonce replay in server_step](https://junglewise.ai/threats/cve-2026-86219-authen-sasl-perl-digest-md5-nonce-replay-in-server-step) (critical, CVSS 9.8, published 6 Sep 2026)
- [CVE-2026-82560: Perl Pod::Text denial of service via pathological =over nesting](https://junglewise.ai/threats/cve-2026-82560-pod-text-versions-before-6-1-1-for-perl-allow-cpu-and-memory) (high, CVSS 7.5, published 19 Sep 2026)
- [CVE-2026-15743: Catalyst::Plugin::Static::Simple improper cache control in static file serving](https://junglewise.ai/threats/cve-2026-15743-catalyst-plugin-static-simple-improper-cache-control-in-static) (medium, CVSS 5.7, published 20 Aug 2026)
- [CVE-2026-12087: Perl Socket out-of-bounds heap read in pack_ip_mreq_source](https://junglewise.ai/threats/cve-2026-12087-perl-socket-out-of-bounds-heap-read-in-pack-ip-mreq-source) (info, CVSS 3.7, published 15 Jun 2026)
- [CVE-2017-20285: YAML Perl arbitrary code execution via DESTROY method](https://junglewise.ai/threats/cve-2017-20285-yaml-versions-before-1-30-for-perl-allow-a-loaded-document-to) (info, published 5 Oct 2026)
- [CVE-2026-120212: Web::Simple HTML::Tags single-quoted attribute XSS](https://junglewise.ai/threats/cve-2026-120212-web-simple-versions-before-0-037-for-perl-do-not-escape-single) (info, published 10 Nov 2026)
- [CVE-2026-121006: HTTP::Body Perl trailer parsing quadratic time complexity denial of service](https://junglewise.ai/threats/cve-2026-121006-http-body-versions-before-1-24-02-for-perl-parse-the-trailer-in) (info, published 6 Nov 2026)
- [CVE-2026-120651: Perl CGI infinite loop in read_postdata_putdata with disabled uploads](https://junglewise.ai/threats/cve-2026-120651-cgi-versions-before-5-00-for-perl-allow-an-infinite-loop-on-a) (info, published 4 Nov 2026)

## Vulnerabilities per week

34 vulnerabilities in the last four weeks, up 750% on the four before (4). 0 critical against 1.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 1 | 0 | 0 |
| 24 Aug 2026 | 0 | 0 | 0 |
| 31 Aug 2026 | 1 | 1 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 1 | 0 | 0 |
| 21 Sep 2026 | 1 | 1 | 0 |
| 28 Sep 2026 | 1 | 0 | 0 |
| 5 Oct 2026 | 1 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 6 | 0 | 0 |
| 26 Oct 2026 | 9 | 0 | 0 |
| 2 Nov 2026 | 19 | 0 | 0 |
| 9 Nov 2026 | 1 | 0 | 0 |

## Perl technologies

- [Perl CGI](https://junglewise.ai/threats/technologies/perl-cgi): 13 vulnerabilities
- [Perl MIME-tools](https://junglewise.ai/threats/technologies/mime-tools): 5 vulnerabilities
- [Perl HTTP::Body](https://junglewise.ai/threats/technologies/http-body): 3 vulnerabilities
- [Perl DBI](https://junglewise.ai/threats/technologies/perl-dbi): 3 vulnerabilities
- [Perl Web::Simple](https://junglewise.ai/threats/technologies/web-simple): 3 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Perl vulnerabilities", https://junglewise.ai/threats/vendors/perl, 11 November 2026.